<!DOCTYPE html>
<!-- saved from url=(0042)https://frida.re/docs/javascript-api/#objc -->
<html lang="en-US" class=" js no-flexbox canvas canvastext webgl no-touch geolocation postmessage websqldatabase indexeddb hashchange history draganddrop websockets rgba hsla multiplebgs backgroundsize borderimage borderradius boxshadow textshadow opacity cssanimations csscolumns cssgradients cssreflections csstransforms csstransforms3d csstransitions fontface generatedcontent video audio localstorage sessionstorage webworkers applicationcache svg inlinesvg smil svgclippaths"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  
  <meta name="viewport" content="width=device-width,initial-scale=1">
  <meta name="generator" content="Jekyll v3.7.3">
  <link type="application/atom+xml" rel="alternate" href="https://www.frida.re/feed.xml" title="Frida • A world-class dynamic instrumentation framework">
  <link rel="alternate" type="application/atom+xml" title="Recent commits to Frida’s master branch" href="https://github.com/frida/frida/commits/master.atom">
  <link rel="stylesheet" href="./JavaScript API _ Frida • A world-class dynamic instrumentation framework_files/screen.css">
  <link rel="icon" type="image/png" href="https://frida.re/favicon.ico">
  <!-- Begin Jekyll SEO tag v2.4.0 -->
<title>JavaScript API | Frida • A world-class dynamic instrumentation framework</title>
<meta name="generator" content="Jekyll v3.7.3">
<meta property="og:title" content="JavaScript API">
<meta property="og:locale" content="en_US">
<meta name="description" content="Inject JavaScript to explore native apps on Windows, macOS, GNU/Linux, iOS, Android, and QNX">
<meta property="og:description" content="Inject JavaScript to explore native apps on Windows, macOS, GNU/Linux, iOS, Android, and QNX">
<link rel="canonical" href="https://www.frida.re/docs/javascript-api/">
<meta property="og:url" content="https://www.frida.re/docs/javascript-api/">
<meta property="og:site_name" content="Frida • A world-class dynamic instrumentation framework">
<meta property="og:type" content="article">
<meta property="article:published_time" content="2019-12-10T06:43:21+01:00">
<meta name="twitter:card" content="summary">
<meta name="twitter:site" content="@fridadotre">
<script type="text/javascript" async="" src="./JavaScript API _ Frida • A world-class dynamic instrumentation framework_files/ga.js"></script><script type="application/ld+json">
{"description":"Inject JavaScript to explore native apps on Windows, macOS, GNU/Linux, iOS, Android, and QNX","@type":"BlogPosting","url":"https://www.frida.re/docs/javascript-api/","headline":"JavaScript API","dateModified":"2019-12-10T06:43:21+01:00","datePublished":"2019-12-10T06:43:21+01:00","mainEntityOfPage":{"@type":"WebPage","@id":"https://www.frida.re/docs/javascript-api/"},"@context":"http://schema.org"}</script>
<!-- End Jekyll SEO tag -->

  <script src="./JavaScript API _ Frida • A world-class dynamic instrumentation framework_files/modernizr-2.5.3.min.js"></script>
</head>


<body class="wrap">
  <header>
  <nav class="mobile-nav show-on-mobiles">
    <ul>
  <li class="">
    <a href="https://frida.re/">Overview</a>
  </li>
  <li class="current">
    <a href="https://frida.re/docs/home/">Docs</a>
  </li>
  <li class="">
    <a href="https://frida.re/news/">News</a>
  </li>
  <li class="">
    <a href="https://github.com/frida/frida">Code</a>
  </li>
  <li class="">
    <a href="https://frida.re/contact/">Contact</a>
  </li>
</ul>

  </nav>
  <div class="grid">
    <div class="logotype unit one-third center-on-mobiles">
      <a href="https://frida.re/">
        <span>FЯIDA</span>
        <img src="./JavaScript API _ Frida • A world-class dynamic instrumentation framework_files/logotype.svg" width="205" height="39" alt="">
      </a>
    </div>
    <nav class="main-nav unit two-thirds hide-on-mobiles">
      <ul>
  <li class="">
    <a href="https://frida.re/">Overview</a>
  </li>
  <li class="current">
    <a href="https://frida.re/docs/home/">Docs</a>
  </li>
  <li class="">
    <a href="https://frida.re/news/">News</a>
  </li>
  <li class="">
    <a href="https://github.com/frida/frida">Code</a>
  </li>
  <li class="">
    <a href="https://frida.re/contact/">Contact</a>
  </li>
</ul>

    </nav>
  </div>
</header>


    <section class="docs">
    <div class="grid">

      <div class="docs-nav-mobile unit whole show-on-mobiles">
  <select onchange="if (this.value) window.location.href=this.value">
    <option value="">Navigate the docs…</option>
    
    <optgroup label="Getting Started">
      


  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/home/">Welcome</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/quickstart/">Quick-start guide</option>
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/installation/">Installation</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/modes/">Modes of Operation</option>
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/gadget/">Gadget</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/hacking/">Hacking</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/presentations/">Presentations</option>
    
  
    
  
    
  
    
  


    </optgroup>
    
    <optgroup label="Tutorials">
      


  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/functions/">Functions</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/messages/">Messages</option>
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/ios/">iOS</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
      <option value="/docs/android/">Android</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  


    </optgroup>
    
    <optgroup label="Examples">
      


  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/examples/windows/">Windows</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/examples/macos/">macOS</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/examples/linux/">Linux</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/examples/ios/">iOS</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/examples/android/">Android</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/examples/javascript/">JavaScript</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  


    </optgroup>
    
    <optgroup label="Tools">
      


  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/frida-cli/">Frida CLI</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/frida-ps/">frida-ps</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/frida-trace/">frida-trace</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/frida-discover/">frida-discover</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/frida-ls-devices/">frida-ls-devices</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/frida-kill/">frida-kill</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  


    </optgroup>
    
    <optgroup label="API Reference">
      


  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/javascript-api/">JavaScript API</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
      <option value="/docs/c-api/">C API</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/swift-api/">Swift API</option>
    
  
    
  


    </optgroup>
    
    <optgroup label="Miscellaneous">
      


  

  
    
  
    
      <option value="/docs/best-practices/">Best Practices</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/troubleshooting/">Troubleshooting</option>
    
  

  

  
    
  
    
  
    
      <option value="/docs/building/">Building</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  


    </optgroup>
    
    <optgroup label="Meta">
      


  

  
    
  
    
  
    
  
    
  
    
      <option value="/docs/contributing/">Contributing</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/gsoc-ideas-2015/">GSoC Ideas 2015</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  

  

  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
      <option value="/docs/history/">History</option>
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  
    
  


    </optgroup>
    
  </select>
</div>

      <div class="docs-nav-desktop unit one-quarter hide-on-mobiles">
  <aside>
    
    <h4>Getting Started</h4>
    

<ul>

  

  

  
  <li class=""><a href="https://frida.re/docs/home/">Welcome</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/quickstart/">Quick-start guide</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/installation/">Installation</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/modes/">Modes of Operation</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/gadget/">Gadget</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/hacking/">Hacking</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/presentations/">Presentations</a></li>


</ul>

    
    <h4>Tutorials</h4>
    

<ul>

  

  

  
  <li class=""><a href="https://frida.re/docs/functions/">Functions</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/messages/">Messages</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/ios/">iOS</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/android/">Android</a></li>


</ul>

    
    <h4>Examples</h4>
    

<ul>

  

  

  
  <li class=""><a href="https://frida.re/docs/examples/windows/">Windows</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/examples/macos/">macOS</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/examples/linux/">Linux</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/examples/ios/">iOS</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/examples/android/">Android</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/examples/javascript/">JavaScript</a></li>


</ul>

    
    <h4>Tools</h4>
    

<ul>

  

  

  
  <li class=""><a href="https://frida.re/docs/frida-cli/">Frida CLI</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/frida-ps/">frida-ps</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/frida-trace/">frida-trace</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/frida-discover/">frida-discover</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/frida-ls-devices/">frida-ls-devices</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/frida-kill/">frida-kill</a></li>


</ul>

    
    <h4>API Reference</h4>
    

<ul>

  

  

  
  <li class="current"><a href="https://frida.re/docs/javascript-api/">JavaScript API</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/c-api/">C API</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/swift-api/">Swift API</a></li>


</ul>

    
    <h4>Miscellaneous</h4>
    

<ul>

  

  

  
  <li class=""><a href="https://frida.re/docs/best-practices/">Best Practices</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/troubleshooting/">Troubleshooting</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/building/">Building</a></li>


</ul>

    
    <h4>Meta</h4>
    

<ul>

  

  

  
  <li class=""><a href="https://frida.re/docs/contributing/">Contributing</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/gsoc-ideas-2015/">GSoC Ideas 2015</a></li>


  

  

  
  <li class=""><a href="https://frida.re/docs/history/">History</a></li>


</ul>

    
  </aside>
</div>


      <div class="docs-articles unit three-quarters">
        <article>
          <div class="improve right hide-on-mobiles">
            <a href="https://github.com/frida/frida-website/edit/master/_docs/javascript-api.md"><i class="fa fa-pencil"></i>Improve this page</a>
          </div>
          <h1>JavaScript API</h1>
          <h2 id="table-of-contents">Table of contents</h2>
<ol>
  <li><a href="https://frida.re/docs/javascript-api/#global">Global</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#console">console</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#rpc">rpc</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#frida">Frida</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#script">Script</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#process">Process</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#module">Module</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#modulemap">ModuleMap</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#memory">Memory</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#memoryaccessmonitor">MemoryAccessMonitor</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#thread">Thread</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#int64">Int64</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#uint64">UInt64</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#nativepointer">NativePointer</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#nativefunction">NativeFunction</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#nativecallback">NativeCallback</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#systemfunction">SystemFunction</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#socket">Socket</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#socketlistener">SocketListener</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#socketconnection">SocketConnection</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#iostream">IOStream</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#inputstream">InputStream</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#outputstream">OutputStream</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#unixinputstream">UnixInputStream</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#unixoutputstream">UnixOutputStream</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#win32inputstream">Win32InputStream</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#win32outputstream">Win32OutputStream</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#file">File</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#sqlitedatabase">SqliteDatabase</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#sqlitestatement">SqliteStatement</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#interceptor">Interceptor</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#stalker">Stalker</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#apiresolver">ApiResolver</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#debugsymbol">DebugSymbol</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#cmodule">CModule</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#instruction">Instruction</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#kernel">Kernel</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#objc">ObjC</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#java">Java</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#weakref">WeakRef</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#x86writer">X86Writer</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#x86relocator">X86Relocator</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#x86enums">x86 enum types</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#armwriter">ArmWriter</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#armrelocator">ArmRelocator</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#thumbwriter">ThumbWriter</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#thumbrelocator">ThumbRelocator</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#armenums">ARM enum types</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#arm64writer">Arm64Writer</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#arm64relocator">Arm64Relocator</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#arm64enums">AArch64 enum types</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#mipswriter">MipsWriter</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#mipsrelocator">MipsRelocator</a></li>
  <li><a href="https://frida.re/docs/javascript-api/#mipsenums">MIPS enum types</a></li>
</ol>

<h2 id="global">Global</h2>

<ul>
  <li>
    <p><code>hexdump(target[, options])</code>: generate a hexdump from the provided
<em>ArrayBuffer</em> or <em>NativePointer</em> <code>target</code>, optionally with <code>options</code> for
customizing the output.</p>

    <p>For example:</p>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kd">var</span> <span class="nx">libc</span> <span class="o">=</span> <span class="nx">Module</span><span class="p">.</span><span class="nx">findBaseAddress</span><span class="p">(</span><span class="s1">'libc.so'</span><span class="p">);</span>
<span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="nx">hexdump</span><span class="p">(</span><span class="nx">libc</span><span class="p">,</span> <span class="p">{</span>
  <span class="nx">offset</span><span class="o">:</span> <span class="mi">0</span><span class="p">,</span>
  <span class="nx">length</span><span class="o">:</span> <span class="mi">64</span><span class="p">,</span>
  <span class="nx">header</span><span class="o">:</span> <span class="kc">true</span><span class="p">,</span>
  <span class="nx">ansi</span><span class="o">:</span> <span class="kc">true</span>
<span class="p">}));</span></code></pre></figure>

<figure class="highlight"><pre><code class="language-sh" data-lang="sh"><span></span>           <span class="m">0</span>  <span class="m">1</span>  <span class="m">2</span>  <span class="m">3</span>  <span class="m">4</span>  <span class="m">5</span>  <span class="m">6</span>  <span class="m">7</span>  <span class="m">8</span>  <span class="m">9</span>  A  B  C  D  E  F  0123456789ABCDEF
<span class="m">00000000</span>  7f <span class="m">45</span> 4c <span class="m">46</span> <span class="m">01</span> <span class="m">01</span> <span class="m">01</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span>  .ELF............
<span class="m">00000010</span>  <span class="m">03</span> <span class="m">00</span> <span class="m">28</span> <span class="m">00</span> <span class="m">01</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> <span class="m">34</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span>  ..<span class="o">(</span>.........4...
<span class="m">00000020</span>  <span class="m">34</span> a8 <span class="m">04</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> <span class="m">05</span> <span class="m">34</span> <span class="m">00</span> <span class="m">20</span> <span class="m">00</span> <span class="m">08</span> <span class="m">00</span> <span class="m">28</span> <span class="m">00</span>  <span class="m">4</span>.......4. ...<span class="o">(</span>.
<span class="m">00000030</span>  1e <span class="m">00</span> 1d <span class="m">00</span> <span class="m">06</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> <span class="m">34</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> <span class="m">34</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span>  ........4...4...</code></pre></figure>

<ul>
  <li>
    <p><code>int64(v)</code>: short-hand for <code>new Int64(v)</code></p>
  </li>
  <li>
    <p><code>uint64(v)</code>: short-hand for <code>new UInt64(v)</code></p>
  </li>
  <li>
    <p><code>ptr(s)</code>: short-hand for <code>new NativePointer(s)</code></p>
  </li>
  <li>
    <p><code>NULL</code>: short-hand for <code>ptr("0")</code></p>
  </li>
  <li>
    <p><code>recv([type, ]callback)</code>: request <code>callback</code> to be called on the next
message received from your Frida-based application. Optionally <code>type</code> may
be specified to only receive a message where the <code>type</code> field is set to
<code>type</code>.</p>

    <p>This will only give you one message, so you need to call <code>recv()</code> again
to receive the next one.</p>
  </li>
  <li>
    <p><code>send(message[, data])</code>: send the JavaScript object <code>message</code> to your
Frida-based application (it must be serializable to JSON). If you also have
some raw binary data that you’d like to send along with it, e.g. you dumped
some memory using <code>NativePointer#readByteArray</code>, then you may pass this
through the optional <code>data</code> argument. This requires it to either be an
ArrayBuffer or an array of integers between 0 and 255.</p>
  </li>
</ul>

<div class="note">
  <h5>Performance considerations</h5>
  <p>
    While <i>send()</i> is asynchronous, the total overhead of sending a single
    message is not optimized for high frequencies, so that means Frida leaves
    it up to you to batch multiple values into a single <i>send()</i>-call,
    based on whether low delay or high throughput is desired.
  </p>
</div>

<ul>
  <li>
    <p><code>setTimeout(func, delay[, ...parameters])</code>: call <code>func</code> after <code>delay</code>
milliseconds, optionally passing it one or more <code>parameters</code>.
Returns an id that can be passed to <code>clearTimeout</code> to cancel it.</p>
  </li>
  <li>
    <p><code>clearTimeout(id)</code>: cancel id returned by call to <code>setTimeout</code>.</p>
  </li>
  <li>
    <p><code>setInterval(func, delay[, ...parameters])</code>: call <code>func</code> every <code>delay</code>
milliseconds, optionally passing it one or more <code>parameters</code>.
Returns an id that can be passed to <code>clearInterval</code> to cancel it.</p>
  </li>
  <li>
    <p><code>clearInterval(id)</code>: cancel id returned by call to <code>setInterval</code>.</p>
  </li>
  <li>
    <p><code>setImmediate(func[, ...parameters])</code>: schedules <code>func</code> to be called on
Frida’s JavaScript thread as soon as possible, optionally passing it one
or more <code>parameters</code>.
Returns an id that can be passed to <code>clearImmediate</code> to cancel it.</p>
  </li>
  <li>
    <p><code>clearImmediate(id)</code>: cancel id returned by call to <code>setImmediate</code>.</p>
  </li>
  <li>
    <p><code>gc()</code>: force garbage collection. Useful for testing <code>WeakRef.bind()</code> logic,
but also sometimes needed when using the Duktape runtime and its default GC
heuristics proving a bit too lazy.</p>
  </li>
</ul>

<h2 id="console">console</h2>

<ul>
  <li>
    <p><code>console.log(line)</code>, <code>console.warn(line)</code>, <code>console.error(line)</code>:
write <code>line</code> to the console of your Frida-based application. The exact
behavior depends on where <a href="https://github.com/frida/frida-core">frida-core</a>
is integrated.
For example, this output goes to <em>stdout</em> or <em>stderr</em> when using Frida
through <a href="https://github.com/frida/frida-python">frida-python</a>,
<a href="https://doc.qt.io/qt-5/qdebug.html">qDebug</a> when using
<a href="https://github.com/frida/frida-qml">frida-qml</a>, etc.</p>

    <p>Arguments that are ArrayBuffer objects will be substituted by the result of
<code>hexdump()</code> with default options.</p>
  </li>
</ul>

<h2 id="rpc">rpc</h2>

<ul>
  <li><code>rpc.exports</code>: empty object that you can either replace or insert into to
expose an RPC-style API to your application. The key specifies the method
name and the value is your exported function. This function may either
return a plain value for returning that to the caller immediately, or a
Promise for returning asynchronously.</li>
</ul>

<blockquote>
  <p>For example:</p>
</blockquote>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="nx">rpc</span><span class="p">.</span><span class="nx">exports</span> <span class="o">=</span> <span class="p">{</span>
  <span class="nx">add</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">a</span><span class="p">,</span> <span class="nx">b</span><span class="p">)</span> <span class="p">{</span>
    <span class="k">return</span> <span class="nx">a</span> <span class="o">+</span> <span class="nx">b</span><span class="p">;</span>
  <span class="p">},</span>
  <span class="nx">sub</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">a</span><span class="p">,</span> <span class="nx">b</span><span class="p">)</span> <span class="p">{</span>
    <span class="k">return</span> <span class="k">new</span> <span class="nb">Promise</span><span class="p">(</span><span class="kd">function</span> <span class="p">(</span><span class="nx">resolve</span><span class="p">)</span> <span class="p">{</span>
      <span class="nx">setTimeout</span><span class="p">(</span><span class="kd">function</span> <span class="p">()</span> <span class="p">{</span>
        <span class="nx">resolve</span><span class="p">(</span><span class="nx">a</span> <span class="o">-</span> <span class="nx">b</span><span class="p">);</span>
      <span class="p">},</span> <span class="mi">100</span><span class="p">);</span>
    <span class="p">});</span>
  <span class="p">}</span>
<span class="p">};</span></code></pre></figure>

<blockquote>
  <p>From an application using the Node.js bindings this API would be consumed
  like this:</p>
</blockquote>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kr">const</span> <span class="nx">frida</span> <span class="o">=</span> <span class="nx">require</span><span class="p">(</span><span class="s1">'frida'</span><span class="p">);</span>
<span class="kr">const</span> <span class="nx">fs</span> <span class="o">=</span> <span class="nx">require</span><span class="p">(</span><span class="s1">'fs'</span><span class="p">);</span>
<span class="kr">const</span> <span class="nx">path</span> <span class="o">=</span> <span class="nx">require</span><span class="p">(</span><span class="s1">'path'</span><span class="p">);</span>
<span class="kr">const</span> <span class="nx">util</span> <span class="o">=</span> <span class="nx">require</span><span class="p">(</span><span class="s1">'util'</span><span class="p">);</span>

<span class="kr">const</span> <span class="nx">readFile</span> <span class="o">=</span> <span class="nx">util</span><span class="p">.</span><span class="nx">promisify</span><span class="p">(</span><span class="nx">fs</span><span class="p">.</span><span class="nx">readFile</span><span class="p">);</span>

<span class="kd">let</span> <span class="nx">session</span><span class="p">,</span> <span class="nx">script</span><span class="p">;</span>
<span class="nx">async</span> <span class="kd">function</span> <span class="nx">run</span><span class="p">()</span> <span class="p">{</span>
  <span class="kr">const</span> <span class="nx">source</span> <span class="o">=</span> <span class="nx">await</span> <span class="nx">readFile</span><span class="p">(</span><span class="nx">path</span><span class="p">.</span><span class="nx">join</span><span class="p">(</span><span class="nx">__dirname</span><span class="p">,</span> <span class="s1">'_agent.js'</span><span class="p">),</span> <span class="s1">'utf8'</span><span class="p">);</span>
  <span class="nx">session</span> <span class="o">=</span> <span class="nx">await</span> <span class="nx">frida</span><span class="p">.</span><span class="nx">attach</span><span class="p">(</span><span class="s1">'iTunes'</span><span class="p">);</span>
  <span class="nx">script</span> <span class="o">=</span> <span class="nx">await</span> <span class="nx">session</span><span class="p">.</span><span class="nx">createScript</span><span class="p">(</span><span class="nx">source</span><span class="p">);</span>
  <span class="nx">script</span><span class="p">.</span><span class="nx">message</span><span class="p">.</span><span class="nx">connect</span><span class="p">(</span><span class="nx">onMessage</span><span class="p">);</span>
  <span class="nx">await</span> <span class="nx">script</span><span class="p">.</span><span class="nx">load</span><span class="p">();</span>
  <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="nx">await</span> <span class="nx">script</span><span class="p">.</span><span class="nx">exports</span><span class="p">.</span><span class="nx">add</span><span class="p">(</span><span class="mi">2</span><span class="p">,</span> <span class="mi">3</span><span class="p">));</span>
  <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="nx">await</span> <span class="nx">script</span><span class="p">.</span><span class="nx">exports</span><span class="p">.</span><span class="nx">sub</span><span class="p">(</span><span class="mi">5</span><span class="p">,</span> <span class="mi">3</span><span class="p">));</span>
<span class="p">}</span>

<span class="nx">run</span><span class="p">().</span><span class="k">catch</span><span class="p">(</span><span class="nx">onError</span><span class="p">);</span>

<span class="kd">function</span> <span class="nx">onError</span><span class="p">(</span><span class="nx">error</span><span class="p">)</span> <span class="p">{</span>
  <span class="nx">console</span><span class="p">.</span><span class="nx">error</span><span class="p">(</span><span class="nx">error</span><span class="p">.</span><span class="nx">stack</span><span class="p">);</span>
<span class="p">}</span>

<span class="kd">function</span> <span class="nx">onMessage</span><span class="p">(</span><span class="nx">message</span><span class="p">,</span> <span class="nx">data</span><span class="p">)</span> <span class="p">{</span>
  <span class="k">if</span> <span class="p">(</span><span class="nx">message</span><span class="p">.</span><span class="nx">type</span> <span class="o">===</span> <span class="s1">'send'</span><span class="p">)</span> <span class="p">{</span>
    <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="nx">message</span><span class="p">.</span><span class="nx">payload</span><span class="p">);</span>
  <span class="p">}</span> <span class="k">else</span> <span class="k">if</span> <span class="p">(</span><span class="nx">message</span><span class="p">.</span><span class="nx">type</span> <span class="o">===</span> <span class="s1">'error'</span><span class="p">)</span> <span class="p">{</span>
    <span class="nx">console</span><span class="p">.</span><span class="nx">error</span><span class="p">(</span><span class="nx">message</span><span class="p">.</span><span class="nx">stack</span><span class="p">);</span>
  <span class="p">}</span>
<span class="p">}</span></code></pre></figure>

<blockquote>
  <p>The Python version would be very similar:</p>
</blockquote>

<figure class="highlight"><pre><code class="language-py" data-lang="py"><span></span><span class="kn">import</span> <span class="nn">codecs</span>
<span class="kn">import</span> <span class="nn">frida</span>

<span class="k">def</span> <span class="nf">on_message</span><span class="p">(</span><span class="n">message</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
    <span class="k">if</span> <span class="n">message</span><span class="p">[</span><span class="s1">'type'</span><span class="p">]</span> <span class="o">==</span> <span class="s1">'send'</span><span class="p">:</span>
        <span class="k">print</span><span class="p">(</span><span class="n">message</span><span class="p">[</span><span class="s1">'payload'</span><span class="p">])</span>
    <span class="k">elif</span> <span class="n">message</span><span class="p">[</span><span class="s1">'type'</span><span class="p">]</span> <span class="o">==</span> <span class="s1">'error'</span><span class="p">:</span>
        <span class="k">print</span><span class="p">(</span><span class="n">message</span><span class="p">[</span><span class="s1">'stack'</span><span class="p">])</span>

<span class="n">session</span> <span class="o">=</span> <span class="n">frida</span><span class="o">.</span><span class="n">attach</span><span class="p">(</span><span class="s1">'iTunes'</span><span class="p">)</span>
<span class="k">with</span> <span class="n">codecs</span><span class="o">.</span><span class="n">open</span><span class="p">(</span><span class="s1">'./agent.js'</span><span class="p">,</span> <span class="s1">'r'</span><span class="p">,</span> <span class="s1">'utf-8'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
    <span class="n">source</span> <span class="o">=</span> <span class="n">f</span><span class="o">.</span><span class="n">read</span><span class="p">()</span>
<span class="n">script</span> <span class="o">=</span> <span class="n">session</span><span class="o">.</span><span class="n">create_script</span><span class="p">(</span><span class="n">source</span><span class="p">)</span>
<span class="n">script</span><span class="o">.</span><span class="n">on</span><span class="p">(</span><span class="s1">'message'</span><span class="p">,</span> <span class="n">on_message</span><span class="p">)</span>
<span class="n">script</span><span class="o">.</span><span class="n">load</span><span class="p">()</span>
<span class="k">print</span><span class="p">(</span><span class="n">script</span><span class="o">.</span><span class="n">exports</span><span class="o">.</span><span class="n">add</span><span class="p">(</span><span class="mi">2</span><span class="p">,</span> <span class="mi">3</span><span class="p">))</span>
<span class="k">print</span><span class="p">(</span><span class="n">script</span><span class="o">.</span><span class="n">exports</span><span class="o">.</span><span class="n">sub</span><span class="p">(</span><span class="mi">5</span><span class="p">,</span> <span class="mi">3</span><span class="p">))</span>
<span class="n">session</span><span class="o">.</span><span class="n">detach</span><span class="p">()</span></code></pre></figure>

<p>In the example above we used <code>script.on('message', on_message)</code> to monitor for any messages from the injected process, JavaScript side.  There are other notifications that you can watch for as well on both the <code>script</code> and <code>session</code>.  If you want to be notified when the target process exits, use <code>session.on('detached', your_function)</code>.</p>

<h2 id="frida">Frida</h2>

<ul>
  <li>
    <p><code>Frida.version</code>: property containing the current Frida version, as a string.</p>
  </li>
  <li>
    <p><code>Frida.heapSize</code>: dynamic property containing the current size of Frida’s
private heap, shared by all scripts and Frida’s own runtime. This is useful
for keeping an eye on how much memory your instrumentation is using out of
the total consumed by the hosting process.</p>
  </li>
</ul>

<h2 id="script">Script</h2>

<ul>
  <li><code>Script.runtime</code>: string property containing the runtime being used.
Either <code>DUK</code> or <code>V8</code>.</li>
</ul>

<h2 id="process">Process</h2>

<ul>
  <li>
    <p><code>Process.id</code>: property containing the PID as a number</p>
  </li>
  <li>
    <p><code>Process.arch</code>: property containing the string <code>ia32</code>, <code>x64</code>, <code>arm</code>
or <code>arm64</code></p>
  </li>
  <li>
    <p><code>Process.platform</code>: property containing the string <code>windows</code>,
<code>darwin</code>, <code>linux</code> or <code>qnx</code></p>
  </li>
  <li>
    <p><code>Process.pageSize</code>: property containing the size of a virtual memory page
(in bytes) as a number. This is used to make your scripts more portable.</p>
  </li>
  <li>
    <p><code>Process.pointerSize</code>: property containing the size of a pointer
(in bytes) as a number. This is used to make your scripts more portable.</p>
  </li>
  <li>
    <p><code>Process.codeSigningPolicy</code>: property containing the string <code>optional</code> or
<code>required</code>, where the latter means Frida will avoid modifying existing code
in memory and will not try to run unsigned code. Currently this property
will always be set to <code>optional</code> unless you are using <a href="https://frida.re/docs/gadget">Gadget</a>
and have configured it to assume that code-signing is required. This
property allows you to determine whether the <a href="https://frida.re/docs/javascript-api/#interceptor">Interceptor</a> API
is off limits, and whether it is safe to modify code or run unsigned code.</p>
  </li>
  <li>
    <p><code>Process.isDebuggerAttached()</code>: returns a boolean indicating whether a
debugger is currently attached</p>
  </li>
  <li>
    <p><code>Process.getCurrentThreadId()</code>: get this thread’s OS-specific id as a number</p>
  </li>
  <li>
    <p><code>Process.enumerateThreads()</code>: enumerates all threads, returning an array of
objects containing the following properties:</p>

    <ul>
      <li><code>id</code>: OS-specific id</li>
      <li><code>state</code>: string specifying either <code>running</code>, <code>stopped</code>, <code>waiting</code>,
<code>uninterruptible</code> or <code>halted</code></li>
      <li><code>context</code>: object with the keys <code>pc</code> and <code>sp</code>, which are
NativePointer objects specifying EIP/RIP/PC and ESP/RSP/SP,
respectively, for ia32/x64/arm. Other processor-specific keys
are also available, e.g. <code>eax</code>, <code>rax</code>, <code>r0</code>, <code>x0</code>, etc.</li>
    </ul>
  </li>
  <li>
    <p><code>Process.findModuleByAddress(address)</code>,
<code>Process.getModuleByAddress(address)</code>,
<code>Process.findModuleByName(name)</code>,
<code>Process.getModuleByName(name)</code>:
returns a <a href="https://frida.re/docs/javascript-api/#module">Module</a> whose <em>address</em> or <em>name</em> matches the one
specified. In the event that no such module could be found, the
<em>find</em>-prefixed functions return <em>null</em> whilst the <em>get</em>-prefixed functions
throw an exception.</p>
  </li>
  <li>
    <p><code>Process.enumerateModules()</code>: enumerates modules loaded right now, returning
an array of <a href="https://frida.re/docs/javascript-api/#module">Module</a> objects.</p>
  </li>
  <li>
    <p><code>Process.findRangeByAddress(address)</code>, <code>getRangeByAddress(address)</code>:
return an object with details about the range containing <em>address</em>. In the
event that no such range could be found, <em>findRangeByAddress()</em> returns
<em>null</em> whilst <em>getRangeByAddress()</em> throws an exception.  See
<code>Process.enumerateRanges()</code> for details about which fields are included.</p>
  </li>
  <li>
    <p><code>Process.enumerateRanges(protection|specifier)</code>: enumerates memory ranges
satisfying <code>protection</code> given as a string of the form: <code>rwx</code>, where <code>rw-</code>
means “must be at least readable and writable”. Alternatively you may
provide a <code>specifier</code> object with a <code>protection</code> key whose value is as
aforementioned, and a <code>coalesce</code> key set to <code>true</code> if you’d like neighboring
ranges with the same protection to be coalesced (the default is <code>false</code>;
i.e. keeping the ranges separate). Returns an array of objects containing
the following properties:</p>

    <ul>
      <li><code>base</code>: base address as a <code>NativePointer</code></li>
      <li><code>size</code>: size in bytes</li>
      <li><code>protection</code>: protection string (see above)</li>
      <li>
        <p><code>file</code>: (when available) file mapping details as an object
containing:</p>

        <ul>
          <li><code>path</code>: full filesystem path as a string</li>
          <li><code>offset</code>: offset in the mapped file on disk, in bytes</li>
          <li><code>size</code>: size in the mapped file on disk, in bytes</li>
        </ul>
      </li>
    </ul>
  </li>
  <li>
    <p><code>Process.enumerateMallocRanges()</code>: just like <code>enumerateRanges()</code>, but for
individual memory allocations known to the system heap.</p>
  </li>
  <li>
    <p><code>Process.setExceptionHandler(callback)</code>: install a process-wide exception
handler callback that gets a chance to handle native exceptions before the
hosting process itself does. Called with a single argument, <code>details</code>, that
is an object containing:</p>

    <ul>
      <li><code>type</code>: string specifying one of:
        <ul>
          <li>abort</li>
          <li>access-violation</li>
          <li>guard-page</li>
          <li>illegal-instruction</li>
          <li>stack-overflow</li>
          <li>arithmetic</li>
          <li>breakpoint</li>
          <li>single-step</li>
          <li>system</li>
        </ul>
      </li>
      <li><code>address</code>: address where the exception occurred, as a NativePointer</li>
      <li><code>memory</code>: if present, is an object containing:
        <ul>
          <li><code>operation</code>: the kind of operation that triggered the exception, as
a string specifying either <code>read</code>, <code>write</code>, or <code>execute</code></li>
          <li><code>address</code>: address that was accessed when the exception occurred, as
a NativePointer</li>
        </ul>
      </li>
      <li><code>context</code>: object with the keys <code>pc</code> and <code>sp</code>, which are
NativePointer objects specifying EIP/RIP/PC and ESP/RSP/SP,
respectively, for ia32/x64/arm. Other processor-specific keys
are also available, e.g. <code>eax</code>, <code>rax</code>, <code>r0</code>, <code>x0</code>, etc.
You may also update register values by assigning to these keys.</li>
      <li><code>nativeContext</code>: address of the OS and architecture-specific CPU context
struct, as a NativePointer. This is only exposed as a last resort for
edge-cases where <code>context</code> isn’t providing enough details. We would
however discourage using this and rather submit a pull-request to add
the missing bits needed for your use-case.</li>
    </ul>

    <p>It is up to your callback to decide what to do with the exception. It could
log the issue, notify your application through a send() followed by a
blocking recv() for acknowledgement of the sent data being received, or
it can modify registers and memory to recover from the exception. You should
return <code>true</code> if you did handle the exception, in which case Frida will
resume the thread immediately. If you do not return <code>true</code>, Frida will
forward the exception to the hosting process’ exception handler, if it has
one, or let the OS terminate the process.</p>
  </li>
</ul>

<h2 id="module">Module</h2>

<pre><code>Objects returned by e.g. `Module.load()` and `Process.enumerateModules()`.
</code></pre>

<ul>
  <li>
    <p><code>name</code>: canonical module name as a string</p>
  </li>
  <li>
    <p><code>base</code>: base address as a <code>NativePointer</code></p>
  </li>
  <li>
    <p><code>size</code>: size in bytes</p>
  </li>
  <li>
    <p><code>path</code>: full filesystem path as a string</p>
  </li>
  <li>
    <p><code>enumerateImports()</code>: enumerates imports of module, returning an array of
objects containing the following properties:</p>

    <ul>
      <li><code>type</code>: string specifying either <code>function</code> or <code>variable</code></li>
      <li><code>name</code>: import name as a string</li>
      <li><code>module</code>: module name as a string</li>
      <li><code>address</code>: absolute address as a <code>NativePointer</code></li>
      <li><code>slot</code>: memory location where the import is stored, as a
<code>NativePointer</code></li>
    </ul>

    <p>Only the <code>name</code> field is guaranteed to be present for all imports. The
platform-specific backend will do its best to resolve the other fields
even beyond what the native metadata provides, but there is no guarantee
that it will succeed.</p>
  </li>
  <li>
    <p><code>enumerateExports()</code>: enumerates exports of module, returning an array
of objects containing the following properties:</p>

    <ul>
      <li><code>type</code>: string specifying either <code>function</code> or <code>variable</code></li>
      <li><code>name</code>: export name as a string</li>
      <li><code>address</code>: absolute address as a <code>NativePointer</code></li>
    </ul>
  </li>
  <li>
    <p><code>enumerateSymbols()</code>: enumerates symbols of module, returning an array of
objects containing the following properties:</p>

    <ul>
      <li><code>isGlobal</code>: boolean specifying whether symbol is globally visible</li>
      <li><code>type</code>: string specifying one of:
        <ul>
          <li>unknown</li>
          <li>section</li>
          <li>undefined (Mach-O)</li>
          <li>absolute (Mach-O)</li>
          <li>prebound-undefined (Mach-O)</li>
          <li>indirect (Mach-O)</li>
          <li>object (ELF)</li>
          <li>function (ELF)</li>
          <li>file (ELF)</li>
          <li>common (ELF)</li>
          <li>tls (ELF)</li>
        </ul>
      </li>
      <li><code>section</code>: if present, is an object containing:
        <ul>
          <li><code>id</code>: string containing section index, segment name (if
      applicable) and section name – same format as
      <a href="http://radare.org/r/">r2</a>’s section IDs</li>
          <li><code>protection</code>: protection like in <code>Process.enumerateRanges()</code></li>
        </ul>
      </li>
      <li><code>name</code>: symbol name as a string</li>
      <li><code>address</code>: absolute address as a <code>NativePointer</code></li>
      <li><code>size</code>: if present, a number specifying the symbol’s size in bytes</li>
    </ul>
  </li>
</ul>

<div class="note info">
  <h5>enumerateSymbols() is only available on i/macOS and Linux-based OSes</h5>
  <p>
    We would love to support this on the other platforms too, so if you find
    this useful and would like to help out, please get in touch. You may also
    find the DebugSymbol API adequate, depending on your use-case.
  </p>
</div>

<ul>
  <li>
    <p><code>enumerateRanges(protection)</code>: just like <code>Process.enumerateRanges</code>, except
it’s scoped to the module.</p>
  </li>
  <li>
    <p><code>findExportByName(exportName)</code>,
<code>getExportByName(exportName)</code>: returns the absolute address of the export
named <code>exportName</code>. In the event that no such export could be found, the
<em>find</em>-prefixed function returns <em>null</em> whilst the <em>get</em>-prefixed function
throws an exception.</p>
  </li>
  <li>
    <p><code>Module.load(name)</code>: loads the specified module and returns a <code>Module</code>
object. Throws an exception if the specified module cannot be loaded.</p>
  </li>
  <li>
    <p><code>Module.ensureInitialized(name)</code>: ensures that initializers of the specified
module have been run. This is important during early instrumentation, i.e.
code run early in the process lifetime, to be able to safely interact with
APIs. One such use-case is interacting with <a href="https://frida.re/docs/javascript-api/#objc">ObjC</a> classes provided
by a given module.</p>
  </li>
  <li>
    <p><code>Module.findBaseAddress(name)</code>,
<code>Module.getBaseAddress(name)</code>: returns the base address of the <code>name</code>
module. In the event that no such module could be found, the <em>find</em>-prefixed
function returns <em>null</em> whilst the <em>get</em>-prefixed function throws an
exception.</p>
  </li>
  <li>
    <p><code>Module.findExportByName(moduleName|null, exportName)</code>,
<code>Module.getExportByName(moduleName|null, exportName)</code>: returns the absolute
address of the export named <code>exportName</code> in <code>moduleName</code>. If the module
isn’t known you may pass <code>null</code> instead of its name, but this can be a
costly search and should be avoided. In the event that no such module or
export could be found, the <em>find</em>-prefixed function returns <em>null</em> whilst
the <em>get</em>-prefixed function throws an exception.</p>
  </li>
</ul>

<h2 id="modulemap">ModuleMap</h2>

<ul>
  <li>
    <p><code>new ModuleMap([filter])</code>: create a new module map optimized for determining
which module a given memory address belongs to, if any. Takes a snapshot of
the currently loaded modules when created, which may be refreshed by calling
<code>update()</code>. The <code>filter</code> argument is optional and allows you to pass a
function used for filtering the list of modules. This is useful if you e.g.
only care about modules owned by the application itself, and allows you to
quickly check if an address belongs to one of its modules. The <code>filter</code>
function is passed a <a href="https://frida.re/docs/javascript-api/#module">Module</a> object and must return <code>true</code> for
each module that should be kept in the map. It is called for each loaded
module every time the map is updated.</p>
  </li>
  <li>
    <p><code>has(address)</code>: check if <code>address</code> belongs to any of the contained modules,
and returns the result as a boolean</p>
  </li>
  <li>
    <p><code>find(address)</code>, <code>get(address)</code>: returns a <a href="https://frida.re/docs/javascript-api/#module">Module</a> with details
about the module that <code>address</code> belongs to. In the event that no such module
could be found, <code>find()</code> returns <code>null</code> whilst <code>get()</code> throws an exception.</p>
  </li>
  <li>
    <p><code>findName(address)</code>,
<code>getName(address)</code>,
<code>findPath(address)</code>,
<code>getPath(address)</code>:
just like <code>find()</code> and <code>get()</code>, but only returns the <code>name</code> or <code>path</code>
field, which means less overhead when you don’t need the other details.</p>
  </li>
  <li>
    <p><code>update()</code>: update the map. You should call this after a module has been
loaded or unloaded to avoid operating on stale data.</p>
  </li>
  <li>
    <p><code>values()</code>: returns an array with the <a href="https://frida.re/docs/javascript-api/#module">Module</a> objects currently in
the map. The returned array is a deep copy and will not mutate after a call
to <code>update()</code>.</p>
  </li>
</ul>

<h2 id="memory">Memory</h2>

<ul>
  <li>
    <p><code>Memory.scan(address, size, pattern, callbacks)</code>: scan memory for
occurences of <code>pattern</code> in the memory range given by <code>address</code> and <code>size</code>.</p>

    <ul>
      <li>
        <p><code>pattern</code> must be of the form “13 37 ?? ff” to match 0x13 followed by
0x37 followed by any byte followed by 0xff.
For more advanced matching it is also possible to specify an
<a href="http://radare.org/r/">r2</a>-style mask. The mask is bitwise AND-ed against both the needle
and the haystack. To specify the mask append a <code>:</code> character after the
needle, followed by the mask using the same syntax.
For example: “13 37 13 37 : 1f ff ff f1”.
For convenience it is also possible to specify nibble-level wildcards,
like “?3 37 13 ?7”, which gets translated into masks behind the scenes.</p>
      </li>
      <li>
        <p><code>callbacks</code> is an object with:</p>

        <ul>
          <li>
            <p><code>onMatch: function (address, size)</code>: called with <code>address</code>
containing the address of the occurence as a <code>NativePointer</code> and
<code>size</code> specifying the size as a number.</p>

            <p>This function may return the string <code>stop</code> to cancel the memory
scanning early.</p>
          </li>
          <li>
            <p><code>onError: function (reason)</code>: called with <code>reason</code> when there was a
memory access error while scanning</p>
          </li>
          <li>
            <p><code>onComplete: function ()</code>: called when the memory range has been
fully scanned</p>
          </li>
        </ul>
      </li>
    </ul>
  </li>
  <li>
    <p><code>Memory.scanSync(address, size, pattern)</code>: synchronous version of <code>scan()</code>
that returns the matches in an array.</p>
  </li>
  <li>
    <p><code>Memory.alloc(size)</code>: allocate <code>size</code> bytes of memory on the heap, or, if
<code>size</code> is a multiple of <code>Process.pageSize</code>, one or more raw memory pages
managed by the OS. The returned value is a <code>NativePointer</code> and the
underlying memory will be released when all JavaScript handles to it are
gone. This means you need to keep a reference to it while the pointer is
being used by code outside the JavaScript runtime.</p>
  </li>
  <li>
    <p><code>Memory.copy(dst, src, n)</code>: just like memcpy.</p>
  </li>
  <li>
    <p><code>Memory.dup(address, size)</code>: short-hand for <code>Memory.alloc()</code> followed by
<code>Memory.copy()</code>.</p>
  </li>
  <li>
    <p><code>Memory.protect(address, size, protection)</code>: update protection on a region
of memory, where <code>protection</code> is a string of the same format as
<code>Process.enumerateRanges()</code>.</p>

    <p>For example:</p>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="nx">Memory</span><span class="p">.</span><span class="nx">protect</span><span class="p">(</span><span class="nx">ptr</span><span class="p">(</span><span class="s1">'0x1234'</span><span class="p">),</span> <span class="mi">4096</span><span class="p">,</span> <span class="s1">'rw-'</span><span class="p">);</span></code></pre></figure>

<ul>
  <li>
    <p><code>Memory.patchCode(address, size, apply)</code>: safely modify <code>size</code> bytes at
<code>address</code>, specified as a NativePointer. The supplied JavaScript function
<code>apply</code> gets called with a writable pointer where you must write the desired
modifications before returning. Do not make any assumptions about this being
the same location as <code>address</code>, as some systems require modifications to be
written to a temporary location before being mapped into memory on top of
the original memory page (e.g. on iOS, where directly modifying in-memory
code may result in the process losing its CS_VALID status).</p>

    <p>For example:</p>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kd">var</span> <span class="nx">getLivesLeft</span> <span class="o">=</span> <span class="nx">Module</span><span class="p">.</span><span class="nx">getExportByName</span><span class="p">(</span><span class="s1">'game-engine.so'</span><span class="p">,</span> <span class="s1">'get_lives_left'</span><span class="p">);</span>
<span class="kd">var</span> <span class="nx">maxPatchSize</span> <span class="o">=</span> <span class="mi">64</span><span class="p">;</span> <span class="c1">// Do not write out of bounds, may be a temporary buffer!</span>
<span class="nx">Memory</span><span class="p">.</span><span class="nx">patchCode</span><span class="p">(</span><span class="nx">getLivesLeft</span><span class="p">,</span> <span class="nx">maxPatchSize</span><span class="p">,</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">code</span><span class="p">)</span> <span class="p">{</span>
  <span class="kd">var</span> <span class="nx">cw</span> <span class="o">=</span> <span class="k">new</span> <span class="nx">X86Writer</span><span class="p">(</span><span class="nx">code</span><span class="p">,</span> <span class="p">{</span> <span class="nx">pc</span><span class="o">:</span> <span class="nx">getLivesLeft</span> <span class="p">});</span>
  <span class="nx">cw</span><span class="p">.</span><span class="nx">putMovRegU32</span><span class="p">(</span><span class="s1">'eax'</span><span class="p">,</span> <span class="mi">9000</span><span class="p">);</span>
  <span class="nx">cw</span><span class="p">.</span><span class="nx">putRet</span><span class="p">();</span>
  <span class="nx">cw</span><span class="p">.</span><span class="nx">flush</span><span class="p">();</span>
<span class="p">});</span></code></pre></figure>

<ul>
  <li><code>Memory.allocUtf8String(str)</code>,
<code>Memory.allocUtf16String(str)</code>,
<code>Memory.allocAnsiString(str)</code>:
allocate, encode and write out <code>str</code> as a UTF-8/UTF-16/ANSI string on the
heap. The returned object is a <code>NativePointer</code>. See <code>Memory#alloc</code> for
details about its lifetime.</li>
</ul>

<h2 id="memoryaccessmonitor">MemoryAccessMonitor</h2>

<ul>
  <li>
    <p><code>MemoryAccessMonitor.enable(ranges, callbacks)</code>: monitor one or more memory
ranges for access, and notify on the first access of each contained memory
page. <code>ranges</code> is either a single range object or an array of such objects,
each of which contains:</p>

    <ul>
      <li><code>base</code>: base address as a <code>NativePointer</code></li>
      <li><code>size</code>: size in bytes</li>
    </ul>

    <p><code>callbacks</code> is an object specifying:</p>

    <ul>
      <li><code>onAccess: function (details)</code>: called synchronously with <code>details</code>
object containing:
        <ul>
          <li><code>operation</code>: the kind of operation that triggered the access, as a
string specifying either <code>read</code>, <code>write</code>, or <code>execute</code></li>
          <li><code>from</code>: address of instruction performing the access as a
<code>NativePointer</code></li>
          <li><code>address</code>: address being accessed as a <code>NativePointer</code></li>
          <li><code>rangeIndex</code>: index of the accessed range in the ranges provided to
<code>MemoryAccessMonitor.enable()</code></li>
          <li><code>pageIndex</code>: index of the accessed memory page inside the specified
range</li>
          <li><code>pagesCompleted</code>: overall number of pages which have been accessed
so far (and are no longer being monitored)</li>
          <li><code>pagesTotal</code>: overall number of pages that were initially monitored</li>
        </ul>
      </li>
    </ul>
  </li>
  <li>
    <p><code>MemoryAccessMonitor.disable()</code>: stop monitoring the remaining memory ranges
passed to <code>MemoryAccessMonitor.enable()</code></p>
  </li>
</ul>

<h2 id="thread">Thread</h2>

<ul>
  <li>
    <p><code>Thread.backtrace([context, backtracer])</code>: generate a backtrace for the
current thread, returned as an array of <code>NativePointer</code> objects.</p>

    <p>If you call this from Interceptor’s <code>onEnter</code> or <code>onLeave</code> callbacks you
should provide <code>this.context</code> for the optional <code>context</code> argument, as it
will give you a more accurate backtrace. Omitting <code>context</code> means the
backtrace will be generated from the current stack location, which may
not give you a very good backtrace due to V8’s stack frames.
The optional <code>backtracer</code> argument specifies the kind of backtracer to use,
and must be either <code>Backtracer.FUZZY</code> or <code>Backtracer.ACCURATE</code>, where the
latter is the default if not specified. The accurate kind of backtracers
rely on debugger-friendly binaries or presence of debug information to do a
good job, whereas the fuzzy backtracers perform forensics on the stack in
order to guess the return addresses, which means you will get false
positives, but it will work on any binary.</p>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kd">var</span> <span class="nx">f</span> <span class="o">=</span> <span class="nx">Module</span><span class="p">.</span><span class="nx">getExportByName</span><span class="p">(</span><span class="s1">'libcommonCrypto.dylib'</span><span class="p">,</span>
    <span class="s1">'CCCryptorCreate'</span><span class="p">);</span>
<span class="nx">Interceptor</span><span class="p">.</span><span class="nx">attach</span><span class="p">(</span><span class="nx">f</span><span class="p">,</span> <span class="p">{</span>
  <span class="nx">onEnter</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">args</span><span class="p">)</span> <span class="p">{</span>
    <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'CCCryptorCreate called from:\n'</span> <span class="o">+</span>
        <span class="nx">Thread</span><span class="p">.</span><span class="nx">backtrace</span><span class="p">(</span><span class="k">this</span><span class="p">.</span><span class="nx">context</span><span class="p">,</span> <span class="nx">Backtracer</span><span class="p">.</span><span class="nx">ACCURATE</span><span class="p">)</span>
        <span class="p">.</span><span class="nx">map</span><span class="p">(</span><span class="nx">DebugSymbol</span><span class="p">.</span><span class="nx">fromAddress</span><span class="p">).</span><span class="nx">join</span><span class="p">(</span><span class="s1">'\n'</span><span class="p">)</span> <span class="o">+</span> <span class="s1">'\n'</span><span class="p">);</span>
  <span class="p">}</span>
<span class="p">});</span></code></pre></figure>

<ul>
  <li><code>Thread.sleep(delay)</code>: suspend execution of the current thread for <code>delay</code>
seconds specified as a number. For example 0.05 to sleep for 50 ms.</li>
</ul>

<h2 id="int64">Int64</h2>

<ul>
  <li>
    <p><code>new Int64(v)</code>: create a new Int64 from <code>v</code>, which is either a number or a
string containing a value in decimal, or hexadecimal if prefixed with “0x”.
You may use the <code>int64(v)</code> short-hand for brevity.</p>
  </li>
  <li>
    <p><code>add(rhs)</code>, <code>sub(rhs)</code>,
<code>and(rhs)</code>, <code>or(rhs)</code>,
<code>xor(rhs)</code>:
make a new Int64 with this Int64 plus/minus/and/or/xor <code>rhs</code>, which may
either be a number or another Int64</p>
  </li>
  <li>
    <p><code>shr(n)</code>, <code>shl(n)</code>:
make a new Int64 with this Int64 shifted right/left by <code>n</code> bits</p>
  </li>
  <li>
    <p><code>compare(rhs)</code>: returns an integer comparison result just like
String#localeCompare()</p>
  </li>
  <li>
    <p><code>toNumber()</code>: cast this Int64 to a number</p>
  </li>
  <li>
    <p><code>toString([radix = 10])</code>: convert to a string of optional radix (defaults to
10)</p>
  </li>
</ul>

<h2 id="uint64">UInt64</h2>

<ul>
  <li>
    <p><code>new UInt64(v)</code>: create a new UInt64 from <code>v</code>, which is either a number or a
string containing a value in decimal, or hexadecimal if prefixed with “0x”.
You may use the <code>uint64(v)</code> short-hand for brevity.</p>
  </li>
  <li>
    <p><code>add(rhs)</code>, <code>sub(rhs)</code>,
<code>and(rhs)</code>, <code>or(rhs)</code>,
<code>xor(rhs)</code>:
make a new UInt64 with this UInt64 plus/minus/and/or/xor <code>rhs</code>, which may
either be a number or another UInt64</p>
  </li>
  <li>
    <p><code>shr(n)</code>, <code>shl(n)</code>:
make a new UInt64 with this UInt64 shifted right/left by <code>n</code> bits</p>
  </li>
  <li>
    <p><code>compare(rhs)</code>: returns an integer comparison result just like
String#localeCompare()</p>
  </li>
  <li>
    <p><code>toNumber()</code>: cast this UInt64 to a number</p>
  </li>
  <li>
    <p><code>toString([radix = 10])</code>: convert to a string of optional radix (defaults to
10)</p>
  </li>
</ul>

<h2 id="nativepointer">NativePointer</h2>

<ul>
  <li>
    <p><code>new NativePointer(s)</code>: creates a new NativePointer from the string <code>s</code>
containing a memory address in either decimal, or hexadecimal if prefixed
with ‘0x’. You may use the <code>ptr(s)</code> short-hand for brevity.</p>
  </li>
  <li>
    <p><code>isNull()</code>: returns a boolean allowing you to conveniently check if a
pointer is NULL</p>
  </li>
  <li>
    <p><code>add(rhs)</code>, <code>sub(rhs)</code>,
<code>and(rhs)</code>, <code>or(rhs)</code>,
<code>xor(rhs)</code>:
makes a new NativePointer with this NativePointer plus/minus/and/or/xor
<code>rhs</code>, which may either be a number or another NativePointer</p>
  </li>
  <li>
    <p><code>shr(n)</code>, <code>shl(n)</code>:
makes a new NativePointer with this NativePointer shifted right/left by <code>n</code>
bits</p>
  </li>
  <li>
    <p><code>not()</code>: makes a new NativePointer with this NativePointer’s bits inverted</p>
  </li>
  <li>
    <p><code>equals(rhs)</code>: returns a boolean indicating whether <code>rhs</code> is equal to
this one; i.e. it has the same pointer value</p>
  </li>
  <li>
    <p><code>compare(rhs)</code>: returns an integer comparison result just like
String#localeCompare()</p>
  </li>
  <li>
    <p><code>toInt32()</code>: casts this NativePointer to a signed 32-bit integer</p>
  </li>
  <li>
    <p><code>toString([radix = 16])</code>: converts to a string of optional radix (defaults
to 16)</p>
  </li>
  <li>
    <p><code>toMatchPattern()</code>: returns a string containing a <code>Memory.scan()</code>-compatible
match pattern for this pointer’s raw value</p>
  </li>
  <li>
    <p><code>readPointer()</code>: reads a <code>NativePointer</code> from this memory location.</p>

    <p>A JavaScript exception will be thrown if the address isn’t readable.</p>
  </li>
  <li>
    <p><code>writePointer(ptr)</code>: writes <code>ptr</code> to this memory location.</p>

    <p>A JavaScript exception will be thrown if the address isn’t writable.</p>
  </li>
  <li>
    <p><code>readS8()</code>, <code>readU8()</code>,
<code>readS16()</code>, <code>readU16()</code>,
<code>readS32()</code>, <code>readU32()</code>,
<code>readShort()</code>, <code>readUShort()</code>,
<code>readInt()</code>, <code>readUInt()</code>,
<code>readFloat()</code>, <code>readDouble()</code>:
reads a signed or unsigned 8/16/32/etc. or float/double value from
this memory location and returns it as a number.</p>

    <p>A JavaScript exception will be thrown if the address isn’t readable.</p>
  </li>
  <li>
    <p><code>writeS8(value)</code>, <code>writeU8(value)</code>,
<code>writeS16(value)</code>, <code>writeU16(value)</code>,
<code>writeS32(value)</code>, <code>writeU32(value)</code>,
<code>writeShort(value)</code>, <code>writeUShort(value)</code>,
<code>writeInt(value)</code>, <code>writeUInt(value)</code>,
<code>writeFloat(value)</code>, <code>writeDouble(value)</code>:
writes a signed or unsigned 8/16/32/etc. or float/double <code>value</code> to this
memory location.</p>

    <p>A JavaScript exception will be thrown if the address isn’t writable.</p>
  </li>
  <li>
    <p><code>readS64()</code>, <code>readU64()</code>,
<code>readLong()</code>, <code>readULong()</code>:
reads a signed or unsigned 64-bit, or long-sized, value from this memory
location and returns it as an <a href="https://frida.re/docs/javascript-api/#int64">Int64</a>/<a href="https://frida.re/docs/javascript-api/#uint64">UInt64</a> value.</p>

    <p>A JavaScript exception will be thrown if the address isn’t readable.</p>
  </li>
  <li>
    <p><code>writeS64(value)</code>, <code>writeU64(value)</code>,
<code>writeLong(value)</code>, <code>writeULong(value)</code>:
writes the <a href="https://frida.re/docs/javascript-api/#int64">Int64</a>/<a href="https://frida.re/docs/javascript-api/#uint64">UInt64</a> <code>value</code> to this memory
location.</p>

    <p>A JavaScript exception will be thrown if the address isn’t writable.</p>
  </li>
  <li>
    <p><code>readByteArray(length)</code>: reads <code>length</code> bytes from this memory location, and
returns it as an <em>ArrayBuffer</em>. This buffer may be efficiently transferred
to your Frida-based application by passing it as the second argument to
<code>send()</code>.</p>

    <p>A JavaScript exception will be thrown if any of the <code>length</code> bytes read from
the address isn’t readable.</p>
  </li>
  <li>
    <p><code>writeByteArray(bytes)</code>: writes <code>bytes</code> to this memory location, where
<code>bytes</code> is either an <em>ArrayBuffer</em>, typically returned from
<code>readByteArray()</code>, or an array of integers between 0 and 255. For example:
<code>[ 0x13, 0x37, 0x42 ]</code>.</p>

    <p>A JavaScript exception will be thrown if any of the bytes written to
the address isn’t writable.</p>
  </li>
  <li>
    <p><code>readCString([size = -1])</code>,
<code>readUtf8String([size = -1])</code>,
<code>readUtf16String([length = -1])</code>,
<code>readAnsiString([size = -1])</code>:
reads the bytes at this memory location as an ASCII, UTF-8, UTF-16, or ANSI
string. Supply the optional <code>size</code> argument if you know the size of the
string in bytes, or omit it or specify <em>-1</em> if the string is NUL-terminated.
Likewise you may supply the optional <code>length</code> argument if you know the
length of the string in characters.</p>

    <p>A JavaScript exception will be thrown if any of the <code>size</code> / <code>length</code> bytes
read from the address isn’t readable.</p>

    <p>Note that <code>readAnsiString()</code> is only available (and relevant) on Windows.</p>
  </li>
  <li>
    <p><code>writeUtf8String(str)</code>,
<code>writeUtf16String(str)</code>,
<code>writeAnsiString(str)</code>:
encodes and writes the JavaScript string to this memory location (with
NUL-terminator).</p>

    <p>A JavaScript exception will be thrown if any of the bytes written to
the address isn’t writable.</p>

    <p>Note that <code>writeAnsiString()</code> is only available (and relevant) on Windows.</p>
  </li>
</ul>

<h2 id="nativefunction">NativeFunction</h2>

<ul>
  <li>
    <p><code>new NativeFunction(address, returnType, argTypes[, abi])</code>: create a new
NativeFunction to call the function at <code>address</code> (specified with a
<code>NativePointer</code>), where <code>returnType</code> specifies the return type, and the
<code>argTypes</code> array specifies the argument types. You may optionally also
specify <code>abi</code> if not system default. For variadic functions, add a <code>'...'</code>
entry to <code>argTypes</code> between the fixed arguments and the variadic ones.</p>

    <h3 id="structs--classes-by-value">Structs &amp; Classes by Value</h3>

    <p>As for structs or classes passed by value, instead of a string provide an
array containing the struct’s field types following each other. You may nest
these as deep as desired for representing structs inside structs. Note that
the returned object is also a <code>NativePointer</code>, and can thus be passed to
<code>Interceptor#attach</code>.</p>

    <p>This must match the struct/class exactly, so if you have a struct with three
ints, you must pass <code>['int', 'int', 'int']</code>.</p>

    <p>For a class that has virtual methods, the first parameter will be a pointer
to <a href="https://en.wikipedia.org/wiki/Virtual_method_table">the vtable</a>.</p>

    <p>For C++ scenarios involving a return value that is larger than
<code>Process.pointerSize</code>, a <code>NativePointer</code> to preallocated space must be passed
in as the first parameter. (This scenario is common in WebKit, for example.)</p>

    <p>Example:</p>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="c1">// LargeObject HandyClass::friendlyFunctionName();</span>
<span class="kd">var</span> <span class="nx">friendlyFunctionName</span> <span class="o">=</span> <span class="k">new</span> <span class="nx">NativeFunction</span><span class="p">(</span><span class="nx">friendlyFunctionPtr</span><span class="p">,</span>
    <span class="s1">'void'</span><span class="p">,</span> <span class="p">[</span><span class="s1">'pointer'</span><span class="p">,</span> <span class="s1">'pointer'</span><span class="p">]);</span>
<span class="kd">var</span> <span class="nx">returnValue</span> <span class="o">=</span> <span class="nx">Memory</span><span class="p">.</span><span class="nx">alloc</span><span class="p">(</span><span class="nx">sizeOfLargeObject</span><span class="p">);</span>
<span class="nx">friendlyFunctionName</span><span class="p">(</span><span class="nx">returnValue</span><span class="p">,</span> <span class="nx">thisPtr</span><span class="p">);</span></code></pre></figure>

<pre><code>### Supported Types

-   void
-   pointer
-   int
-   uint
-   long
-   ulong
-   char
-   uchar
-   float
-   double
-   int8
-   uint8
-   int16
-   uint16
-   int32
-   uint32
-   int64
-   uint64
-   bool

### Supported ABIs

-   default

-   Windows 32-bit:
    -   sysv
    -   stdcall
    -   thiscall
    -   fastcall
    -   mscdecl

- Windows 64-bit:
    -   win64

- UNIX x86:
    -   sysv
    -   unix64

- UNIX ARM:
    -   sysv
    -   vfp
</code></pre>

<ul>
  <li>
    <p><code>new NativeFunction(address, returnType, argTypes[, options])</code>: just like
the previous constructor, but where the fourth argument, <code>options</code>, is an
object that may contain one or more of the following keys:</p>

    <ul>
      <li><code>abi</code>: same enum as above.</li>
      <li><code>scheduling</code>: scheduling behavior as a string. Supported values are:
        <ul>
          <li>cooperative: Allow other threads to execute JavaScript code while
             calling the native function, i.e. let go of the lock
             before the call, and re-acquire it afterwards.
             This is the default behavior.</li>
          <li>exclusive: Do not allow other threads to execute JavaScript code
           while calling the native function, i.e. keep holding the
           JavaScript lock.
           This is faster but may result in deadlocks.</li>
        </ul>
      </li>
      <li><code>exceptions</code>: exception behavior as a string. Supported values are:
        <ul>
          <li>steal: If the called function generates a native exception, e.g.
       by dereferencing an invalid pointer, Frida will unwind the
       stack and steal the exception, turning it into a JavaScript
       exception that can be handled. This may leave the application
       in an undefined state, but is useful to avoid crashing the
       process while experimenting.
       This is the default behavior.</li>
          <li>propagate: Let the application deal with any native exceptions that
           occur during the function call. (Or, the handler
           installed through <code>Process.setExceptionHandler()</code>.)</li>
        </ul>
      </li>
      <li><code>traps</code>: code traps to be enabled, as a string. Supported values are:
        <ul>
          <li>default: Interceptor.attach() callbacks will be called if any hooks
         are triggered by a function call.</li>
          <li>all: In addition to Interceptor callbacks, Stalker may also be
     temporarily reactivated for the duration of each function call.
     This is useful for e.g. measuring code coverage while guiding a
     fuzzer, implementing “step into” in a debugger, etc.</li>
        </ul>
      </li>
    </ul>
  </li>
</ul>

<h2 id="nativecallback">NativeCallback</h2>

<ul>
  <li><code>new NativeCallback(func, returnType, argTypes[, abi])</code>: create a new
NativeCallback implemented by the JavaScript function <code>func</code>, where
<code>returnType</code> specifies the return type, and the <code>argTypes</code> array specifies
the argument types. You may also specify the abi if not system default.
See <code>NativeFunction</code> for details about supported types and abis.
Note that the returned object is also a <code>NativePointer</code>, and can thus be
passed to <code>Interceptor#replace</code>.
When using the resulting callback with <em>Interceptor.replace()</em>, <code>func</code> will
be invoked with <code>this</code> bound to an object with some useful properties, just
like the one in <em>Interceptor.attach()</em>.</li>
</ul>

<h2 id="systemfunction">SystemFunction</h2>

<ul>
  <li>
    <p><code>new SystemFunction(address, returnType, argTypes[, abi])</code>: just like
<code>NativeFunction</code>, but also provides a snapshot of the thread’s last error
status. The return value is an object wrapping the actual return value as
<code>value</code>, with one additional platform-specific field named either <code>errno</code>
(UNIX) or <code>lastError</code> (Windows).</p>
  </li>
  <li>
    <p><code>new SystemFunction(address, returnType, argTypes[, options])</code>: same as
above but accepting an <code>options</code> object like <code>NativeFunction</code>’s
corresponding constructor.</p>
  </li>
</ul>

<h2 id="socket">Socket</h2>

<ul>
  <li>
    <p><code>Socket.listen([options])</code>: open a TCP or UNIX listening socket. Returns a
<em>Promise</em> that receives a <a href="https://frida.re/docs/javascript-api/#socketlistener">SocketListener</a>.</p>

    <p>Defaults to listening on both IPv4 and IPv6, if supported, and binding on
all interfaces on a randomly selected TCP port.</p>

    <p>The optional <code>options</code> argument is an object that may contain some of the
following keys:</p>

    <ul>
      <li><code>family</code>: address family as a string. Supported values are:
        <ul>
          <li>unix</li>
          <li>ipv4</li>
          <li>ipv6
Defaults to listening on both <code>ipv4</code> and <code>ipv6</code> if supported.</li>
        </ul>
      </li>
      <li><code>host</code>: (IP family) IP address as a string. Defaults to all interfaces.</li>
      <li><code>port</code>: (IP family) IP port as a number. Defaults to any available.</li>
      <li><code>type</code>: (UNIX family) UNIX socket type as a string. Supported types are:
        <ul>
          <li>anonymous</li>
          <li>path</li>
          <li>abstract</li>
          <li>abstract-padded
Defaults to <code>path</code>.</li>
        </ul>
      </li>
      <li><code>path</code>: (UNIX family) UNIX socket path as a string.</li>
      <li><code>backlog</code>: Listen backlog as a number. Defaults to <code>10</code>.</li>
    </ul>
  </li>
  <li>
    <p><code>Socket.connect(options)</code>: connect to a TCP or UNIX server. Returns a
<em>Promise</em> that receives a <a href="https://frida.re/docs/javascript-api/#socketconnection">SocketConnection</a>.</p>

    <p>The <code>options</code> argument is an object that should contain some of the
following keys:</p>

    <ul>
      <li><code>family</code>: address family as a string. Supported values are:
        <ul>
          <li>unix</li>
          <li>ipv4</li>
          <li>ipv6
Defaults to an IP family depending on the <code>host</code> specified.</li>
        </ul>
      </li>
      <li><code>host</code>: (IP family) IP address as a string. Defaults to <code>localhost</code>.</li>
      <li><code>port</code>: (IP family) IP port as a number.</li>
      <li><code>type</code>: (UNIX family) UNIX socket type as a string. Supported types are:
        <ul>
          <li>anonymous</li>
          <li>path</li>
          <li>abstract</li>
          <li>abstract-padded
Defaults to <code>path</code>.</li>
        </ul>
      </li>
      <li><code>path</code>: (UNIX family) UNIX socket path as a string.</li>
    </ul>
  </li>
  <li>
    <p><code>Socket.type(handle)</code>: inspect the OS socket <code>handle</code> and return its type
as a string which is either <code>tcp</code>, <code>udp</code>, <code>tcp6</code>, <code>udp6</code>, <code>unix:stream</code>,
<code>unix:dgram</code>, or <code>null</code> if invalid or unknown.</p>
  </li>
  <li>
    <p><code>Socket.localAddress(handle)</code>,
<code>Socket.peerAddress(handle)</code>:
inspect the OS socket <code>handle</code> and return its local or peer address, or
<code>null</code> if invalid or unknown.</p>

    <p>The object returned has the fields:</p>

    <ul>
      <li><code>ip</code>: (IP sockets) IP address as a string.</li>
      <li><code>port</code>: (IP sockets) IP port as a number.</li>
      <li><code>path</code>: (UNIX sockets) UNIX path as a string.</li>
    </ul>
  </li>
</ul>

<h2 id="socketlistener">SocketListener</h2>

<pre><code>All methods are fully asynchronous and return Promise objects.
</code></pre>

<ul>
  <li>
    <p><code>path</code>: (UNIX family) path being listened on.</p>
  </li>
  <li>
    <p><code>port</code>: (IP family) IP port being listened on.</p>
  </li>
  <li>
    <p><code>close()</code>: close the listener, releasing resources related to it. Once the
listener is closed, all other operations will fail. Closing a listener
multiple times is allowed and will not result in an error.</p>
  </li>
  <li>
    <p><code>accept()</code>: wait for the next client to connect. The returned <em>Promise</em>
receives a <a href="https://frida.re/docs/javascript-api/#socketconnection">SocketConnection</a>.</p>
  </li>
</ul>

<h2 id="socketconnection">SocketConnection</h2>

<pre><code>Inherits from IOStream.
All methods are fully asynchronous and return Promise objects.
</code></pre>

<ul>
  <li><code>setNoDelay(noDelay)</code>: disable the Nagle algorithm if <code>noDelay</code> is <code>true</code>,
otherwise enable it. The Nagle algorithm is enabled by default, so it is
only necessary to call this method if you wish to optimize for low delay
instead of high throughput.</li>
</ul>

<h2 id="iostream">IOStream</h2>

<pre><code>All methods are fully asynchronous and return Promise objects.
</code></pre>

<ul>
  <li>
    <p><code>input</code>: the <a href="https://frida.re/docs/javascript-api/#inputstream">InputStream</a> to read from.</p>
  </li>
  <li>
    <p><code>output</code>: the <a href="https://frida.re/docs/javascript-api/#outputstream">OutputStream</a> to write to.</p>
  </li>
  <li>
    <p><code>close()</code>: close the stream, releasing resources related to it. This will
also close the individual input and output streams. Once the stream is
closed, all other operations will fail. Closing a stream multiple times is
allowed and will not result in an error.</p>
  </li>
</ul>

<h2 id="inputstream">InputStream</h2>

<pre><code>All methods are fully asynchronous and return Promise objects.
</code></pre>

<ul>
  <li>
    <p><code>close()</code>: close the stream, releasing resources related to it. Once the
stream is closed, all other operations will fail. Closing a stream multiple
times is allowed and will not result in an error.</p>
  </li>
  <li>
    <p><code>read(size)</code>: read up to <code>size</code> bytes from the stream. The returned
<em>Promise</em> receives an <em>ArrayBuffer</em> up to <code>size</code> bytes long. End of stream
is signalled through an empty buffer.</p>
  </li>
  <li>
    <p><code>readAll(size)</code>: keep reading from the stream until exactly <code>size</code> bytes
have been consumed. The returned <em>Promise</em> receives an <em>ArrayBuffer</em> that is
exactly <code>size</code> bytes long. Premature error or end of stream results in the
<em>Promise</em> getting rejected with an error, where the <code>Error</code> object has a
<code>partialData</code> property containing the incomplete data.</p>
  </li>
</ul>

<h2 id="outputstream">OutputStream</h2>

<pre><code>All methods are fully asynchronous and return Promise objects.
</code></pre>

<ul>
  <li>
    <p><code>close()</code>: close the stream, releasing resources related to it. Once the
stream is closed, all other operations will fail. Closing a stream multiple
times is allowed and will not result in an error.</p>
  </li>
  <li>
    <p><code>write(data)</code>: try to write <code>data</code> to the stream. The <code>data</code> value is either
an <em>ArrayBuffer</em> or an array of integers between 0 and 255. The returned
<em>Promise</em> receives a <em>Number</em> specifying how many bytes of <code>data</code> were
written to the stream.</p>
  </li>
  <li>
    <p><code>writeAll(data)</code>: keep writing to the stream until all of <code>data</code> has been
written. The <code>data</code> value is either an <em>ArrayBuffer</em> or an array of integers
between 0 and 255. Premature error or end of stream results in an error,
where the <code>Error</code> object has a <code>partialSize</code> property specifying how many
bytes of <code>data</code> were written to the stream before the error occurred.</p>
  </li>
</ul>

<h2 id="unixinputstream">UnixInputStream</h2>

<pre><code>(Only available on UNIX-like OSes.)
</code></pre>

<ul>
  <li>
    <p><code>new UnixInputStream(fd[, options])</code>: create a new
<a href="https://frida.re/docs/javascript-api/#inputstream">InputStream</a> from the specified file descriptor <code>fd</code>.</p>

    <p>You may also supply an <code>options</code> object with <code>autoClose</code> set to <code>true</code> to
make the stream close the underlying file descriptor when the stream is
released, either through <code>close()</code> or future garbage-collection.</p>
  </li>
</ul>

<h2 id="unixoutputstream">UnixOutputStream</h2>

<pre><code>(Only available on UNIX-like OSes.)
</code></pre>

<ul>
  <li>
    <p><code>new UnixOutputStream(fd[, options])</code>: create a new
<a href="https://frida.re/docs/javascript-api/#outputstream">OutputStream</a> from the specified file descriptor <code>fd</code>.</p>

    <p>You may also supply an <code>options</code> object with <code>autoClose</code> set to <code>true</code> to
make the stream close the underlying file descriptor when the stream is
released, either through <code>close()</code> or future garbage-collection.</p>
  </li>
</ul>

<h2 id="win32inputstream">Win32InputStream</h2>

<pre><code>(Only available on Windows.)
</code></pre>

<ul>
  <li>
    <p><code>new Win32InputStream(handle[, options])</code>: create a new
<a href="https://frida.re/docs/javascript-api/#inputstream">InputStream</a> from the specified <code>handle</code>, which is a Windows
<em>HANDLE</em> value.</p>

    <p>You may also supply an <code>options</code> object with <code>autoClose</code> set to <code>true</code> to
make the stream close the underlying handle when the stream is released,
either through <code>close()</code> or future garbage-collection.</p>
  </li>
</ul>

<h2 id="win32outputstream">Win32OutputStream</h2>

<pre><code>(Only available on Windows.)
</code></pre>

<ul>
  <li>
    <p><code>new Win32OutputStream(handle[, options])</code>: create a new
<a href="https://frida.re/docs/javascript-api/#outputstream">OutputStream</a> from the specified <code>handle</code>, which is a
Windows <em>HANDLE</em> value.</p>

    <p>You may also supply an <code>options</code> object with <code>autoClose</code> set to <code>true</code> to
make the stream close the underlying handle when the stream is released,
either through <code>close()</code> or future garbage-collection.</p>
  </li>
</ul>

<h2 id="file">File</h2>

<ul>
  <li>
    <p><code>new File(filePath, mode)</code>: open or create the file at <code>filePath</code> with
the <code>mode</code> string specifying how it should be opened. For example <code>"wb"</code>
to open the file for writing in binary mode (this is the same format as
<code>fopen()</code> from the C standard library).</p>
  </li>
  <li>
    <p><code>write(data)</code>: synchronously write <code>data</code> to the file, where <code>data</code> is
either a string or a buffer as returned by <code>NativePointer#readByteArray</code></p>
  </li>
  <li>
    <p><code>flush()</code>: flush any buffered data to the underlying file</p>
  </li>
  <li>
    <p><code>close()</code>: close the file. You should call this function when you’re done
with the file unless you are fine with this happening when the object is
garbage-collected or the script is unloaded.</p>
  </li>
</ul>

<h2 id="sqlitedatabase">SqliteDatabase</h2>

<ul>
  <li>
    <p><code>SqliteDatabase.open(path[, options])</code>: opens the SQLite v3 database
specified by <code>path</code>, a string containing the filesystem path to the
database. By default the database will be opened read-write, but you may
customize this behavior by providing an <code>options</code> object with a property
named <code>flags</code>, specifying an array of strings containing one or more of the
following values: <code>readonly</code>, <code>readwrite</code>, <code>create</code>.  The returned
SqliteDatabase object will allow you to perform queries on the database.</p>
  </li>
  <li>
    <p><code>SqliteDatabase.openInline(encodedContents)</code>: just like <code>open()</code> but the
contents of the database is provided as a string containing its data,
Base64-encoded. We recommend gzipping the database before Base64-encoding
it, but this is optional and detected by looking for a gzip magic marker.
The database is opened read-write, but is 100% in-memory and never touches
the filesystem. This is useful for agents that need to bundle a cache of
precomputed data, e.g. static analysis data used to guide dynamic analysis.</p>
  </li>
  <li>
    <p><code>close()</code>: close the database. You should call this function when you’re
done with the database, unless you are fine with this happening when the
object is garbage-collected or the script is unloaded.</p>
  </li>
  <li>
    <p><code>exec(sql)</code>: execute a raw SQL query, where <code>sql</code> is a string containing
the text-representation of the query. The query’s result is ignored, so this
should only be used for queries for setting up the database, e.g. table
creation.</p>
  </li>
  <li>
    <p><code>prepare(sql)</code>: compile the provided SQL into a
<a href="https://frida.re/docs/javascript-api/#sqlitestatement">SqliteStatement</a> object, where <code>sql</code> is a string
containing the text-representation of the query.</p>

    <p>For example:</p>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kd">var</span> <span class="nx">db</span><span class="p">,</span> <span class="nx">smt</span><span class="p">,</span> <span class="nx">row</span><span class="p">,</span> <span class="nx">name</span><span class="p">,</span> <span class="nx">bio</span><span class="p">;</span>

<span class="nx">db</span> <span class="o">=</span> <span class="nx">SqliteDatabase</span><span class="p">.</span><span class="nx">open</span><span class="p">(</span><span class="s1">'/path/to/people.db'</span><span class="p">);</span>

<span class="nx">smt</span> <span class="o">=</span> <span class="nx">db</span><span class="p">.</span><span class="nx">prepare</span><span class="p">(</span><span class="s1">'SELECT name, bio FROM people WHERE age = ?'</span><span class="p">);</span>

<span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'People whose age is 42:'</span><span class="p">);</span>
<span class="nx">smt</span><span class="p">.</span><span class="nx">bindInteger</span><span class="p">(</span><span class="mi">1</span><span class="p">,</span> <span class="mi">42</span><span class="p">);</span>
<span class="k">while</span> <span class="p">((</span><span class="nx">row</span> <span class="o">=</span> <span class="nx">smt</span><span class="p">.</span><span class="nx">step</span><span class="p">())</span> <span class="o">!==</span> <span class="kc">null</span><span class="p">)</span> <span class="p">{</span>
  <span class="nx">name</span> <span class="o">=</span> <span class="nx">row</span><span class="p">[</span><span class="mi">0</span><span class="p">];</span>
  <span class="nx">bio</span> <span class="o">=</span> <span class="nx">row</span><span class="p">[</span><span class="mi">1</span><span class="p">];</span>
  <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'Name:'</span><span class="p">,</span> <span class="nx">name</span><span class="p">);</span>
  <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'Bio:'</span><span class="p">,</span> <span class="nx">bio</span><span class="p">);</span>
<span class="p">}</span>
<span class="nx">smt</span><span class="p">.</span><span class="nx">reset</span><span class="p">();</span></code></pre></figure>

<ul>
  <li><code>dump()</code>: dump the database to a gzip-compressed blob encoded as Base64,
where the result is returned as a string. This is useful for inlining a
cache in your agent’s code, loaded by calling <code>SqliteDatabase.openInline()</code>.</li>
</ul>

<h2 id="sqlitestatement">SqliteStatement</h2>

<ul>
  <li><code>bindInteger(index, value)</code>: bind the integer <code>value</code> to <code>index</code></li>
  <li><code>bindFloat(index, value)</code>: bind the floating point <code>value</code> to <code>index</code></li>
  <li><code>bindText(index, value)</code>: bind the text <code>value</code> to <code>index</code></li>
  <li><code>bindBlob(index, bytes)</code>: bind the blob <code>bytes</code> to <code>index</code>, where <code>bytes</code>
is an ArrayBuffer, array of byte values, or a string</li>
  <li><code>bindNull(index)</code>: bind a null value to <code>index</code></li>
  <li><code>step()</code>: either start a new query and get the first result, or move to the
next one. Returns an array containing the values in the order specified by
the query, or <code>null</code> when the last result is reached. You should call
<code>reset()</code> at that point if you intend to use this object again.</li>
  <li><code>reset()</code>: reset internal state to allow subsequent queries</li>
</ul>

<h2 id="interceptor">Interceptor</h2>

<ul>
  <li>
    <p><code>Interceptor.attach(target, callbacks[, data])</code>: intercept calls to function
at <code>target</code>. This is a <code>NativePointer</code> specifying the address of the
function you would like to intercept calls to. Note that on 32-bit ARM this
address must have its least significant bit set to 0 for ARM functions, and
1 for Thumb functions. Frida takes care of this detail for you if you get
the address from a Frida API (for example <code>Module.getExportByName()</code>).</p>

    <p>The <code>callbacks</code> argument is an object containing one or more of:</p>

    <ul>
      <li>
        <p><code>onEnter: function (args)</code>: callback function given one argument
<code>args</code> that can be used to read or write arguments as an array of
<code>NativePointer</code> objects.</p>
      </li>
      <li>
        <p><code>onLeave: function (retval)</code>: callback function given one argument
<code>retval</code> that is a <code>NativePointer</code>-derived object containing the raw
return value.
You may call <code>retval.replace(1337)</code> to replace the return value with
the integer <code>1337</code>, or <code>retval.replace(ptr("0x1234"))</code> to replace with
a pointer.
Note that this object is recycled across <em>onLeave</em> calls, so do not
store and use it outside your callback. Make a deep copy if you need
to store the contained value, e.g.: <code>ptr(retval.toString())</code>.</p>
      </li>
    </ul>

    <p>In case the hooked function is very hot, <code>onEnter</code> and <code>onLeave</code> may be
<code>NativePointer</code> values pointing at native C functions compiled using
<a href="https://frida.re/docs/javascript-api/#cmodule">CModule</a>. Their signatures are:</p>

    <ul>
      <li>
        <p><code>void onEnter (GumInvocationContext * ic)</code></p>
      </li>
      <li>
        <p><code>void onLeave (GumInvocationContext * ic)</code></p>
      </li>
    </ul>

    <p>In such cases, the third optional argument <code>data</code> may be a <code>NativePointer</code>
accessible through <code>gum_invocation_context_get_listener_function_data()</code>.</p>

    <p>You may also intercept arbitrary instructions by passing a function instead
of the <code>callbacks</code> object. This function has the same signature as
<code>onEnter</code>, but the <code>args</code> argument passed to it will only give you sensible
values if the intercepted instruction is at the beginning of a function or
at a point where registers/stack have not yet deviated from that point.</p>

    <p>Just like above, this function may also be implemented in C by specifying
a <code>NativePointer</code> instead of a function.</p>

    <p>Returns a listener object that you can call <code>detach()</code> on.</p>

    <p>Note that these functions will be invoked with <code>this</code> bound to a
per-invocation (thread-local) object where you can store arbitrary data,
which is useful if you want to read an argument in <code>onEnter</code> and act on it
in <code>onLeave</code>.</p>

    <p>For example:</p>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="nx">Interceptor</span><span class="p">.</span><span class="nx">attach</span><span class="p">(</span><span class="nx">Module</span><span class="p">.</span><span class="nx">getExportByName</span><span class="p">(</span><span class="s1">'libc.so'</span><span class="p">,</span> <span class="s1">'read'</span><span class="p">),</span> <span class="p">{</span>
  <span class="nx">onEnter</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">args</span><span class="p">)</span> <span class="p">{</span>
    <span class="k">this</span><span class="p">.</span><span class="nx">fileDescriptor</span> <span class="o">=</span> <span class="nx">args</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="nx">toInt32</span><span class="p">();</span>
  <span class="p">},</span>
  <span class="nx">onLeave</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">retval</span><span class="p">)</span> <span class="p">{</span>
    <span class="k">if</span> <span class="p">(</span><span class="nx">retval</span><span class="p">.</span><span class="nx">toInt32</span><span class="p">()</span> <span class="o">&gt;</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
      <span class="cm">/* do something with this.fileDescriptor */</span>
    <span class="p">}</span>
  <span class="p">}</span>
<span class="p">});</span></code></pre></figure>

<ul>
  <li>
    <p>Additionally, the object contains some useful properties:</p>

    <ul>
      <li>
        <p><code>returnAddress</code>: return address as a NativePointer</p>
      </li>
      <li>
        <p><code>context</code>: object with the keys <code>pc</code> and <code>sp</code>, which are
NativePointer objects specifying EIP/RIP/PC and ESP/RSP/SP,
respectively, for ia32/x64/arm. Other processor-specific keys
are also available, e.g. <code>eax</code>, <code>rax</code>, <code>r0</code>, <code>x0</code>, etc.
You may also update register values by assigning to these keys.</p>
      </li>
      <li>
        <p><code>errno</code>: (UNIX) current errno value (you may replace it)</p>
      </li>
      <li>
        <p><code>lastError</code>: (Windows) current OS error value (you may replace it)</p>
      </li>
      <li>
        <p><code>threadId</code>: OS thread ID</p>
      </li>
      <li>
        <p><code>depth</code>: call depth of relative to other invocations</p>
      </li>
    </ul>

    <p>For example:</p>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="nx">Interceptor</span><span class="p">.</span><span class="nx">attach</span><span class="p">(</span><span class="nx">Module</span><span class="p">.</span><span class="nx">getExportByName</span><span class="p">(</span><span class="kc">null</span><span class="p">,</span> <span class="s1">'read'</span><span class="p">),</span> <span class="p">{</span>
  <span class="nx">onEnter</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">args</span><span class="p">)</span> <span class="p">{</span>
    <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'Context information:'</span><span class="p">);</span>
    <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'Context  : '</span> <span class="o">+</span> <span class="nx">JSON</span><span class="p">.</span><span class="nx">stringify</span><span class="p">(</span><span class="k">this</span><span class="p">.</span><span class="nx">context</span><span class="p">));</span>
    <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'Return   : '</span> <span class="o">+</span> <span class="k">this</span><span class="p">.</span><span class="nx">returnAddress</span><span class="p">);</span>
    <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'ThreadId : '</span> <span class="o">+</span> <span class="k">this</span><span class="p">.</span><span class="nx">threadId</span><span class="p">);</span>
    <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'Depth    : '</span> <span class="o">+</span> <span class="k">this</span><span class="p">.</span><span class="nx">depth</span><span class="p">);</span>
    <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'Errornr  : '</span> <span class="o">+</span> <span class="k">this</span><span class="p">.</span><span class="nx">err</span><span class="p">);</span>

    <span class="c1">// Save arguments for processing in onLeave.</span>
    <span class="k">this</span><span class="p">.</span><span class="nx">fd</span> <span class="o">=</span> <span class="nx">args</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="nx">toInt32</span><span class="p">();</span>
    <span class="k">this</span><span class="p">.</span><span class="nx">buf</span> <span class="o">=</span> <span class="nx">args</span><span class="p">[</span><span class="mi">1</span><span class="p">];</span>
    <span class="k">this</span><span class="p">.</span><span class="nx">count</span> <span class="o">=</span> <span class="nx">args</span><span class="p">[</span><span class="mi">2</span><span class="p">].</span><span class="nx">toInt32</span><span class="p">();</span>
  <span class="p">},</span>
  <span class="nx">onLeave</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">result</span><span class="p">)</span> <span class="p">{</span>
    <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'----------'</span><span class="p">)</span>
    <span class="c1">// Show argument 1 (buf), saved during onEnter.</span>
    <span class="kd">var</span> <span class="nx">numBytes</span> <span class="o">=</span> <span class="nx">result</span><span class="p">.</span><span class="nx">toInt32</span><span class="p">();</span>
    <span class="k">if</span> <span class="p">(</span><span class="nx">numBytes</span> <span class="o">&gt;</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
      <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="nx">hexdump</span><span class="p">(</span><span class="k">this</span><span class="p">.</span><span class="nx">buf</span><span class="p">,</span> <span class="p">{</span> <span class="nx">length</span><span class="o">:</span> <span class="nx">numBytes</span><span class="p">,</span> <span class="nx">ansi</span><span class="o">:</span> <span class="kc">true</span> <span class="p">}));</span>
    <span class="p">}</span>
    <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'Result   : '</span> <span class="o">+</span> <span class="nx">numBytes</span><span class="p">);</span>
  <span class="p">}</span>
<span class="p">})</span></code></pre></figure>

<div class="note">
  <h5>Performance considerations</h5>
  <p>
    The callbacks provided have a significant impact on performance. If you only
    need to inspect arguments but do not care about the return value, or the
    other way around, make sure you omit the callback that you don't need; i.e.
    avoid putting your logic in <i>onEnter</i> and leaving <i>onLeave</i> in
    there as an empty callback.
  </p>
  <p>
    On an iPhone 5S the base overhead when providing just <i>onEnter</i> might be
    something like 6 microseconds, and 11 microseconds with both <i>onEnter</i>
    and <i>onLeave</i> provided.
  </p>
  <p>
    Also be careful about intercepting calls to functions that are called a
    bazillion times per second; while <i>send()</i> is asynchronous, the total
    overhead of sending a single message is not optimized for high frequencies,
    so that means Frida leaves it up to you to batch multiple values into a
    single <i>send()</i>-call, based on whether low delay or high throughput
    is desired.
  </p>
  <p>
    However when hooking hot functions you may use Interceptor in conjunction
    with CModule to implement the callbacks in C.
  </p>
</div>

<ul>
  <li>
    <p><code>Interceptor.detachAll()</code>: detach all previously attached callbacks.</p>
  </li>
  <li>
    <p><code>Interceptor.replace(target, replacement[, data])</code>: replace function at
<code>target</code> with implementation at <code>replacement</code>. This is typically used if you
want to fully or partially replace an existing function’s implementation.</p>

    <p>Use <code>NativeCallback</code> to implement a <code>replacement</code> in JavaScript.</p>

    <p>In case the replaced function is very hot, you may implement <code>replacement</code>
in C using <a href="https://frida.re/docs/javascript-api/#cmodule">CModule</a>. You may then also specify the third optional
argument <code>data</code>, which is a <code>NativePointer</code> accessible through
<code>gum_invocation_context_get_listener_function_data()</code>. Use
<code>gum_interceptor_get_current_invocation()</code> to get hold of the
<code>GumInvocationContext *</code>.</p>

    <p>Note that <code>replacement</code> will be kept alive until <code>Interceptor#revert</code> is
called.</p>

    <p>If you want to chain to the original implementation you can synchronously
call <code>target</code> through a <code>NativeFunction</code> inside your implementation, which
will bypass and go directly to the original implementation.</p>

    <p>Here’s an example:</p>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kd">var</span> <span class="nx">openPtr</span> <span class="o">=</span> <span class="nx">Module</span><span class="p">.</span><span class="nx">getExportByName</span><span class="p">(</span><span class="s1">'libc.so'</span><span class="p">,</span> <span class="s1">'open'</span><span class="p">);</span>
<span class="kd">var</span> <span class="nx">open</span> <span class="o">=</span> <span class="k">new</span> <span class="nx">NativeFunction</span><span class="p">(</span><span class="nx">openPtr</span><span class="p">,</span> <span class="s1">'int'</span><span class="p">,</span> <span class="p">[</span><span class="s1">'pointer'</span><span class="p">,</span> <span class="s1">'int'</span><span class="p">]);</span>
<span class="nx">Interceptor</span><span class="p">.</span><span class="nx">replace</span><span class="p">(</span><span class="nx">openPtr</span><span class="p">,</span> <span class="k">new</span> <span class="nx">NativeCallback</span><span class="p">(</span><span class="kd">function</span> <span class="p">(</span><span class="nx">pathPtr</span><span class="p">,</span> <span class="nx">flags</span><span class="p">)</span> <span class="p">{</span>
  <span class="kd">var</span> <span class="nx">path</span> <span class="o">=</span> <span class="nx">pathPtr</span><span class="p">.</span><span class="nx">readUtf8String</span><span class="p">();</span>
  <span class="nx">log</span><span class="p">(</span><span class="s1">'Opening "'</span> <span class="o">+</span> <span class="nx">path</span> <span class="o">+</span> <span class="s1">'"'</span><span class="p">);</span>
  <span class="kd">var</span> <span class="nx">fd</span> <span class="o">=</span> <span class="nx">open</span><span class="p">(</span><span class="nx">pathPtr</span><span class="p">,</span> <span class="nx">flags</span><span class="p">);</span>
  <span class="nx">log</span><span class="p">(</span><span class="s1">'Got fd: '</span> <span class="o">+</span> <span class="nx">fd</span><span class="p">);</span>
  <span class="k">return</span> <span class="nx">fd</span><span class="p">;</span>
<span class="p">},</span> <span class="s1">'int'</span><span class="p">,</span> <span class="p">[</span><span class="s1">'pointer'</span><span class="p">,</span> <span class="s1">'int'</span><span class="p">]));</span></code></pre></figure>

<ul>
  <li>
    <p><code>Interceptor.revert(target)</code>: revert function at <code>target</code> to the previous
implementation.</p>
  </li>
  <li>
    <p><code>Interceptor.flush()</code>: ensure any pending changes have been committed
to memory. This is should only be done in the few cases where this is
necessary, e.g. if you just attach()ed to or replace()d a function that you
are about to call using <a href="https://frida.re/docs/javascript-api/#nativefunction">NativeFunction</a>. Pending changes
are flushed automatically whenever the current thread is about to leave the
JavaScript runtime or calls send(). This includes any API built on top of
send(), like when returning from an <a href="https://frida.re/docs/javascript-api/#rpc">RPC</a> method, and calling any
method on the <a href="https://frida.re/docs/javascript-api/#console">console</a> API.</p>
  </li>
</ul>

<h2 id="stalker">Stalker</h2>

<ul>
  <li>
    <p><code>Stalker.exclude(range)</code>: marks the specified memory <code>range</code> as excluded,
which is an object with <code>base</code> and <code>size</code> properties – like the properties
in an object returned by e.g. <code>Process.getModuleByName()</code>.</p>

    <p>This means Stalker will not follow execution when encountering a call to an
instruction in such a range. You will thus be able to observe/modify the
arguments going in, and the return value coming back, but won’t see the
instructions that happened between.</p>

    <p>Useful to improve performance and reduce noise.</p>
  </li>
  <li>
    <p><code>Stalker.follow([threadId, options])</code>: start stalking <code>threadId</code> (or the
current thread if omitted), optionally with <code>options</code> for enabling events.</p>

    <p>For example:</p>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kr">const</span> <span class="nx">mainThread</span> <span class="o">=</span> <span class="nx">Process</span><span class="p">.</span><span class="nx">enumerateThreads</span><span class="p">()[</span><span class="mi">0</span><span class="p">];</span>

<span class="nx">Stalker</span><span class="p">.</span><span class="nx">follow</span><span class="p">(</span><span class="nx">mainThread</span><span class="p">.</span><span class="nx">id</span><span class="p">,</span> <span class="p">{</span>
  <span class="nx">events</span><span class="o">:</span> <span class="p">{</span>
    <span class="nx">call</span><span class="o">:</span> <span class="kc">true</span><span class="p">,</span> <span class="c1">// CALL instructions: yes please</span>

    <span class="c1">// Other events:</span>
    <span class="nx">ret</span><span class="o">:</span> <span class="kc">false</span><span class="p">,</span> <span class="c1">// RET instructions</span>
    <span class="nx">exec</span><span class="o">:</span> <span class="kc">false</span><span class="p">,</span> <span class="c1">// all instructions: not recommended as it's</span>
                 <span class="c1">//                   a lot of data</span>
    <span class="nx">block</span><span class="o">:</span> <span class="kc">false</span><span class="p">,</span> <span class="c1">// block executed: coarse execution trace</span>
    <span class="nx">compile</span><span class="o">:</span> <span class="kc">false</span> <span class="c1">// block compiled: useful for coverage</span>
  <span class="p">},</span>

  <span class="c1">//</span>
  <span class="c1">// Only specify one of the two following callbacks.</span>
  <span class="c1">// (See note below.)</span>
  <span class="c1">//</span>

  <span class="c1">//</span>
  <span class="c1">// onReceive: Called with `events` containing a binary blob</span>
  <span class="c1">//            comprised of one or more GumEvent structs.</span>
  <span class="c1">//            See `gumevent.h` for details about the</span>
  <span class="c1">//            format. Use `Stalker.parse()` to examine the</span>
  <span class="c1">//            data.</span>
  <span class="c1">//</span>
  <span class="c1">//onReceive: function (events) {</span>
  <span class="c1">//},</span>
  <span class="c1">//</span>

  <span class="c1">//</span>
  <span class="c1">// onCallSummary: Called with `summary` being a key-value</span>
  <span class="c1">//                mapping of call target to number of</span>
  <span class="c1">//                calls, in the current time window. You</span>
  <span class="c1">//                would typically implement this instead of</span>
  <span class="c1">//                `onReceive()` for efficiency, i.e. when</span>
  <span class="c1">//                you only want to know which targets were</span>
  <span class="c1">//                called and how many times, but don't care</span>
  <span class="c1">//                about the order that the calls happened</span>
  <span class="c1">//                in.</span>
  <span class="c1">//</span>
  <span class="nx">onCallSummary</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">summary</span><span class="p">)</span> <span class="p">{</span>
  <span class="p">},</span>

  <span class="c1">//</span>
  <span class="c1">// Advanced users: This is how you can plug in your own</span>
  <span class="c1">//                 StalkerTransformer, where the provided</span>
  <span class="c1">//                 function is called synchronously</span>
  <span class="c1">//                 whenever Stalker wants to recompile</span>
  <span class="c1">//                 a basic block of the code that's about</span>
  <span class="c1">//                 to be executed by the stalked thread.</span>
  <span class="c1">//</span>
  <span class="c1">//transform: function (iterator) {</span>
  <span class="c1">//  var instruction = iterator.next();</span>
  <span class="c1">//</span>
  <span class="c1">//  var startAddress = instruction.address;</span>
  <span class="c1">//  var isAppCode = startAddress.compare(appStart) &gt;= 0 &amp;&amp;</span>
  <span class="c1">//      startAddress.compare(appEnd) === -1;</span>
  <span class="c1">//</span>
  <span class="c1">//  do {</span>
  <span class="c1">//    if (isAppCode &amp;&amp; instruction.mnemonic === 'ret') {</span>
  <span class="c1">//      iterator.putCmpRegI32('eax', 60);</span>
  <span class="c1">//      iterator.putJccShortLabel('jb', 'nope', 'no-hint');</span>
  <span class="c1">//</span>
  <span class="c1">//      iterator.putCmpRegI32('eax', 90);</span>
  <span class="c1">//      iterator.putJccShortLabel('ja', 'nope', 'no-hint');</span>
  <span class="c1">//</span>
  <span class="c1">//      iterator.putCallout(onMatch);</span>
  <span class="c1">//</span>
  <span class="c1">//      iterator.putLabel('nope');</span>
  <span class="c1">//    }</span>
  <span class="c1">//</span>
  <span class="c1">//    iterator.keep();</span>
  <span class="c1">//  } while ((instruction = iterator.next()) !== null);</span>
  <span class="c1">//},</span>
  <span class="c1">//</span>
  <span class="c1">// The default implementation is just:</span>
  <span class="c1">//</span>
  <span class="c1">//   while (iterator.next() !== null)</span>
  <span class="c1">//     iterator.keep();</span>
  <span class="c1">//</span>
  <span class="c1">// The example above shows how you can insert your own code</span>
  <span class="c1">// just before every `ret` instruction across any code</span>
  <span class="c1">// executed by the stalked thread inside the app's own</span>
  <span class="c1">// memory range. It inserts code that checks if the `eax`</span>
  <span class="c1">// register contains a value between 60 and 90, and inserts</span>
  <span class="c1">// a synchronous callout back into JavaScript whenever that</span>
  <span class="c1">// is the case. The callback receives a single argument</span>
  <span class="c1">// that gives it access to the CPU registers, and it is</span>
  <span class="c1">// also able to modify them.</span>
  <span class="c1">//</span>
  <span class="c1">// function onMatch (context) {</span>
  <span class="c1">//   console.log('Match! pc=' + context.pc +</span>
  <span class="c1">//       ' rax=' + context.rax.toInt32());</span>
  <span class="c1">// }</span>
  <span class="c1">//</span>
  <span class="c1">// Note that not calling keep() will result in the</span>
  <span class="c1">// instruction getting dropped, which makes it possible</span>
  <span class="c1">// for your transform to fully replace certain instructions</span>
  <span class="c1">// when this is desirable.</span>
  <span class="c1">//</span>

  <span class="c1">//</span>
  <span class="c1">// Want better performance? Write the callbacks in C:</span>
  <span class="c1">//</span>
  <span class="c1">// /*</span>
  <span class="c1">//  * const cm = new CModule(\`</span>
  <span class="c1">//  *</span>
  <span class="c1">//  * #include &lt;gum/gumstalker.h&gt;</span>
  <span class="c1">//  *</span>
  <span class="c1">//  * static void on_ret (GumCpuContext * cpu_context,</span>
  <span class="c1">//  *     gpointer user_data);</span>
  <span class="c1">//  *</span>
  <span class="c1">//  * void</span>
  <span class="c1">//  * transform (GumStalkerIterator * iterator,</span>
  <span class="c1">//  *            GumStalkerWriter * output,</span>
  <span class="c1">//  *            gpointer user_data)</span>
  <span class="c1">//  * {</span>
  <span class="c1">//  *   cs_insn * insn;</span>
  <span class="c1">//  *</span>
  <span class="c1">//  *   while (gum_stalker_iterator_next (iterator, &amp;insn))</span>
  <span class="c1">//  *   {</span>
  <span class="c1">//  *     if (insn-&gt;id == X86_INS_RET)</span>
  <span class="c1">//  *     {</span>
  <span class="c1">//  *       gum_x86_writer_put_nop (output);</span>
  <span class="c1">//  *       gum_stalker_iterator_put_callout (iterator,</span>
  <span class="c1">//  *           on_ret, NULL, NULL);</span>
  <span class="c1">//  *     }</span>
  <span class="c1">//  *</span>
  <span class="c1">//  *     gum_stalker_iterator_keep (iterator);</span>
  <span class="c1">//  *   }</span>
  <span class="c1">//  * }</span>
  <span class="c1">//  *</span>
  <span class="c1">//  * static void</span>
  <span class="c1">//  * on_ret (GumCpuContext * cpu_context,</span>
  <span class="c1">//  *         gpointer user_data)</span>
  <span class="c1">//  * {</span>
  <span class="c1">//  *   printf ("on_ret!\n");</span>
  <span class="c1">//  * }</span>
  <span class="c1">//  *</span>
  <span class="c1">//  * `);</span>
  <span class="c1">//  */</span>
  <span class="c1">//</span>
  <span class="c1">//transform: cm.transform,</span>
  <span class="c1">//data: ptr(1337) /* user_data */</span>
  <span class="c1">//</span>
  <span class="c1">// You may also use a hybrid approach and only write</span>
  <span class="c1">// some of the callouts in C.</span>
  <span class="c1">//</span>
<span class="p">});</span></code></pre></figure>

<div class="note">
  <h5>Performance considerations</h5>
  <p>
    The callbacks provided have a significant impact on performance. If you only
    need periodic call summaries but do not care about the raw events, or the
    other way around, make sure you omit the callback that you don't need; i.e.
    avoid putting your logic in <i>onCallSummary</i> and leaving
    <i>onReceive</i> in there as an empty callback.
  </p>
  <p>
    Also note that Stalker may be used in conjunction with CModule, which means
    the callbacks may be implemented in C.
  </p>
</div>

<ul>
  <li>
    <p><code>Stalker.unfollow([threadId])</code>: stop stalking <code>threadId</code> (or the current
thread if omitted).</p>
  </li>
  <li>
    <p><code>Stalker.parse(events[, options])</code>: parse GumEvent binary blob, optionally
with <code>options</code> for customizing the output.</p>

    <p>For example:</p>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span>  <span class="nx">onReceive</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">events</span><span class="p">)</span> <span class="p">{</span>
    <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="nx">Stalker</span><span class="p">.</span><span class="nx">parse</span><span class="p">(</span><span class="nx">events</span><span class="p">,</span> <span class="p">{</span>
      <span class="nx">annotate</span><span class="o">:</span> <span class="kc">true</span><span class="p">,</span> <span class="c1">// to display the type of event</span>
      <span class="nx">stringify</span><span class="o">:</span> <span class="kc">true</span>
        <span class="c1">// to format pointer values as strings instead of `NativePointer`</span>
        <span class="c1">// values, i.e. less overhead if you're just going to `send()` the </span>
        <span class="c1">// thing not actually parse the data agent-side</span>
    <span class="p">}));</span>
  <span class="p">},</span></code></pre></figure>

<ul>
  <li>
    <p><code>Stalker.flush()</code>: flush out any buffered events. Useful when you don’t want
to wait until the next <code>Stalker.queueDrainInterval</code> tick.</p>
  </li>
  <li>
    <p><code>Stalker.garbageCollect()</code>: free accumulated memory at a safe point after
<code>Stalker#unfollow</code>. This is needed to avoid race-conditions where the
thread just unfollowed is executing its last instructions.</p>
  </li>
  <li>
    <p><code>Stalker.addCallProbe(address, callback[, data])</code>: call <code>callback</code> (see
<code>Interceptor#attach#onEnter</code> for signature) synchronously when a call is
made to <code>address</code>. Returns an id that can be passed to
<code>Stalker#removeCallProbe</code> later.</p>

    <p>It is also possible to implement <code>callback</code> in C using <a href="https://frida.re/docs/javascript-api/#cmodule">CModule</a>,
by specifying a <code>NativePointer</code> instead of a function. Signature:</p>

    <ul>
      <li><code>void onCall (GumCallSite * site, gpointer user_data)</code></li>
    </ul>

    <p>In such cases, the third optional argument <code>data</code> may be a <code>NativePointer</code>
whose value is passed to the callback as <code>user_data</code>.</p>
  </li>
  <li>
    <p><code>Stalker.removeCallProbe</code>: remove a call probe added by
<code>Stalker#addCallProbe</code>.</p>
  </li>
  <li>
    <p><code>Stalker.trustThreshold</code>: an integer specifying how many times a piece of
code needs to be executed before it is assumed it can be trusted to not
mutate.
Specify -1 for no trust (slow), 0 to trust code from the get-go, and N to
trust code after it has been executed N times. Defaults to 1.</p>
  </li>
  <li>
    <p><code>Stalker.queueCapacity</code>: an integer specifying the capacity of the event
queue in number of events. Defaults to 16384 events.</p>
  </li>
  <li>
    <p><code>Stalker.queueDrainInterval</code>: an integer specifying the time in milliseconds
between each time the event queue is drained. Defaults to 250 ms, which
means that the event queue is drained four times per second.</p>
  </li>
</ul>

<h2 id="apiresolver">ApiResolver</h2>

<ul>
  <li>
    <p><code>new ApiResolver(type)</code>: create a new resolver of the given <code>type</code>, allowing
you to quickly find functions by name, with globs permitted. Precisely which
resolvers are available depends on the current platform and runtimes loaded
in the current process. As of the time of writing, the available resolvers
are:</p>

    <ul>
      <li><code>module</code>: Resolves exported and imported functions of shared libraries
          currently loaded. Always available.</li>
      <li><code>objc</code>: Resolves Objective-C methods of classes currently loaded.
        Available on macOS and iOS in processes that have the Objective-C
        runtime loaded. Use <code>ObjC.available</code> to check at runtime, or
        wrap your <code>new ApiResolver('objc')</code> call in a <em>try-catch</em>.</li>
    </ul>

    <p>The resolver will load the minimum amount of data required on creation, and
lazy-load the rest depending on the queries it receives. It is thus
recommended to use the same instance for a batch of queries, but recreate it
for future batches to avoid looking at stale data.</p>
  </li>
  <li>
    <p><code>enumerateMatches(query)</code>: performs the resolver-specific <code>query</code> string,
returning an array of objects containing the following properties:</p>

    <ul>
      <li><code>name</code>: name of the API that was found</li>
      <li><code>address</code>: address as a <code>NativePointer</code></li>
    </ul>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kd">var</span> <span class="nx">resolver</span> <span class="o">=</span> <span class="k">new</span> <span class="nx">ApiResolver</span><span class="p">(</span><span class="s1">'module'</span><span class="p">);</span>
<span class="kd">var</span> <span class="nx">matches</span> <span class="o">=</span> <span class="nx">resolver</span><span class="p">.</span><span class="nx">enumerateMatches</span><span class="p">(</span><span class="s1">'exports:*!open*'</span><span class="p">);</span>
<span class="kd">var</span> <span class="nx">first</span> <span class="o">=</span> <span class="nx">matches</span><span class="p">[</span><span class="mi">0</span><span class="p">];</span>
<span class="cm">/*</span>
<span class="cm"> * Where `first` is an object similar to:</span>
<span class="cm"> *</span>
<span class="cm"> * {</span>
<span class="cm"> *   name: '/usr/lib/libSystem.B.dylib!opendir$INODE64',</span>
<span class="cm"> *   address: ptr('0x7fff870135c9')</span>
<span class="cm"> * }</span>
<span class="cm"> */</span></code></pre></figure>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kd">var</span> <span class="nx">resolver</span> <span class="o">=</span> <span class="k">new</span> <span class="nx">ApiResolver</span><span class="p">(</span><span class="s1">'objc'</span><span class="p">);</span>
<span class="kd">var</span> <span class="nx">matches</span> <span class="o">=</span> <span class="nx">resolver</span><span class="p">.</span><span class="nx">enumerateMatches</span><span class="p">(</span><span class="s1">'-[NSURL* *HTTP*]'</span><span class="p">);</span>
<span class="kd">var</span> <span class="nx">first</span> <span class="o">=</span> <span class="nx">matches</span><span class="p">[</span><span class="mi">0</span><span class="p">];</span>
<span class="cm">/*</span>
<span class="cm"> * Where `first` contains an object like this one:</span>
<span class="cm"> *</span>
<span class="cm"> * {</span>
<span class="cm"> *   name: '-[NSURLRequest valueForHTTPHeaderField:]',</span>
<span class="cm"> *   address: ptr('0x7fff94183e22')</span>
<span class="cm"> * }</span>
<span class="cm"> */</span></code></pre></figure>

<h2 id="debugsymbol">DebugSymbol</h2>

<ul>
  <li>
    <p><code>DebugSymbol.fromAddress(address)</code>, <code>DebugSymbol.fromName(name)</code>:
look up debug information for <code>address</code>/<code>name</code> and return it as an object
containing:</p>

    <ul>
      <li><code>address</code>: Address that this symbol is for, as a <code>NativePointer</code>.</li>
      <li><code>name</code>: Name of the symbol, as a string, or null if unknown.</li>
      <li><code>moduleName</code>: Module name owning this symbol, as a string, or null if
              unknown.</li>
      <li><code>fileName</code>: File name owning this symbol, as a string, or null if
            unknown.</li>
      <li><code>lineNumber</code>: Line number in <code>fileName</code>, as a number, or null if
              unknown.</li>
    </ul>

    <p>You may also call <code>toString()</code> on it, which is very useful when combined
with <code>Thread.backtrace()</code>:</p>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kd">var</span> <span class="nx">f</span> <span class="o">=</span> <span class="nx">Module</span><span class="p">.</span><span class="nx">getExportByName</span><span class="p">(</span><span class="s1">'libcommonCrypto.dylib'</span><span class="p">,</span>
    <span class="s1">'CCCryptorCreate'</span><span class="p">);</span>
<span class="nx">Interceptor</span><span class="p">.</span><span class="nx">attach</span><span class="p">(</span><span class="nx">f</span><span class="p">,</span> <span class="p">{</span>
  <span class="nx">onEnter</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">args</span><span class="p">)</span> <span class="p">{</span>
    <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'CCCryptorCreate called from:\n'</span> <span class="o">+</span>
        <span class="nx">Thread</span><span class="p">.</span><span class="nx">backtrace</span><span class="p">(</span><span class="k">this</span><span class="p">.</span><span class="nx">context</span><span class="p">,</span> <span class="nx">Backtracer</span><span class="p">.</span><span class="nx">ACCURATE</span><span class="p">)</span>
        <span class="p">.</span><span class="nx">map</span><span class="p">(</span><span class="nx">DebugSymbol</span><span class="p">.</span><span class="nx">fromAddress</span><span class="p">).</span><span class="nx">join</span><span class="p">(</span><span class="s1">'\n'</span><span class="p">)</span> <span class="o">+</span> <span class="s1">'\n'</span><span class="p">);</span>
  <span class="p">}</span>
<span class="p">});</span></code></pre></figure>

<ul>
  <li>
    <p><code>DebugSymbol.getFunctionByName(name)</code>: resolves a function name and
returns its address as a <code>NativePointer</code>. Returns the first if more than
one function is found. Throws an exception if the name cannot be resolved.</p>
  </li>
  <li>
    <p><code>DebugSymbol.findFunctionsNamed(name)</code>: resolves a function name and returns
its addresses as an array of <code>NativePointer</code> objects.</p>
  </li>
  <li>
    <p><code>DebugSymbol.findFunctionsMatching(glob)</code>: resolves function names matching
<code>glob</code> and returns their addresses as an array of <code>NativePointer</code> objects.</p>
  </li>
</ul>

<h2 id="cmodule">CModule</h2>

<ul>
  <li>
    <p><code>new CModule(source[, symbols])</code>: compiles C <code>source</code> code string to machine
code, straight to memory.</p>

    <p>Useful for implementing hot callbacks, e.g. for <em>Interceptor</em> and <em>Stalker</em>,
but also useful when needing to start new threads in order to call functions
in a tight loop, e.g. for fuzzing purposes.</p>

    <p>Global functions are automatically exported as <em>NativePointer</em> properties
named exactly like in the C source code. This means you can pass them to
<em>Interceptor</em> and <em>Stalker</em>, or call them using <em>NativeFunction</em>.</p>

    <p>The optional second argument, <code>symbols</code>, is an object specifying additional
symbol names and their <em>NativePointer</em> values, each of which will be plugged
in at creation. This may for example be one or more memory blocks allocated
using <em>Memory.alloc()</em>, and/or <em>NativeCallback</em> values for receiving
callbacks from the C module.</p>

    <p>To perform initialization and cleanup, you may define functions with the
following names and signatures:</p>

    <ul>
      <li><code>void init (void)</code></li>
      <li><code>void finalize (void)</code></li>
    </ul>

    <p>Note that all data is read-only, so writable globals should be declared
<em>extern</em>, allocated using e.g. <em>Memory.alloc()</em>, and passed in as symbols
through the constructor’s second argument.</p>
  </li>
  <li>
    <p><code>dispose()</code>: eagerly unmaps the module from memory. Useful for short-lived
modules when waiting for a future garbage collection isn’t desirable.</p>
  </li>
</ul>

<h2 id="instruction">Instruction</h2>

<ul>
  <li>
    <p><code>Instruction.parse(target)</code>: parse the instruction at the <code>target</code> address
in memory, represented by a <code>NativePointer</code>.
Note that on 32-bit ARM this address must have its least significant bit
set to 0 for ARM functions, and 1 for Thumb functions. Frida takes care
of this detail for you if you get the address from a Frida API (for
example <code>Module.getExportByName()</code>).</p>

    <p>The object returned has the fields:</p>

    <ul>
      <li><code>address</code>: address (EIP) of this instruction, as a <code>NativePointer</code></li>
      <li><code>next</code>: pointer to the next instruction, so you can <code>parse()</code> it</li>
      <li><code>size</code>: size of this instruction</li>
      <li><code>mnemonic</code>: string representation of instruction mnemonic</li>
      <li><code>opStr</code>: string representation of instruction operands</li>
      <li><code>operands</code>: array of objects describing each operand, each specifying
            the <code>type</code> and <code>value</code>, at a minimum, but potentially also
            additional properties depending on the architecture</li>
      <li><code>regsRead</code>: array of register names implicitly read by this instruction</li>
      <li><code>regsWritten</code>: array of register names implicitly written to by this
instruction</li>
      <li><code>groups</code>: array of group names that this instruction belongs to</li>
      <li><code>toString()</code>: convert to a human-readable string</li>
    </ul>

    <p>For details about <code>operands</code> and <code>groups</code>, please consult the
<a href="http://www.capstone-engine.org/">Capstone</a> documentation for your
architecture.</p>
  </li>
</ul>

<h2 id="kernel">Kernel</h2>

<ul>
  <li>
    <p><code>Kernel.available</code>: a boolean specifying whether the Kernel API is
available. Do not invoke any other <code>Kernel</code> properties or methods unless
this is the case.</p>
  </li>
  <li>
    <p><code>Kernel.base</code>: base address of the kernel, as a UInt64.</p>
  </li>
  <li>
    <p><code>Kernel.pageSize</code>: size of a kernel page in bytes, as a number.</p>
  </li>
  <li>
    <p><code>Kernel.enumerateModules()</code>: enumerates kernel modules loaded right now,
returning an array of objects containing the following properties:</p>

    <ul>
      <li><code>name</code>: canonical module name as a string</li>
      <li><code>base</code>: base address as a <code>NativePointer</code></li>
      <li><code>size</code>: size in bytes</li>
    </ul>
  </li>
  <li>
    <p><code>Kernel.enumerateRanges(protection|specifier)</code>: enumerate kernel memory
ranges satisfying <code>protection</code> given as a string of the form: <code>rwx</code>, where
<code>rw-</code> means “must be at least readable and writable”. Alternatively you may
provide a <code>specifier</code> object with a <code>protection</code> key whose value is as
aforementioned, and a <code>coalesce</code> key set to <code>true</code> if you’d like neighboring
ranges with the same protection to be coalesced (the default is <code>false</code>;
i.e. keeping the ranges separate). Returns an array of objects containing
the following properties:</p>

    <ul>
      <li><code>base</code>: base address as a <code>NativePointer</code></li>
      <li><code>size</code>: size in bytes</li>
      <li><code>protection</code>: protection string (see above)</li>
    </ul>
  </li>
  <li>
    <p><code>Kernel.enumerateModuleRanges(name, protection)</code>: just like
<code>Kernel.enumerateRanges</code>, except it’s scoped to the specified module
<code>name</code> – which may be <code>null</code> for the module of the kernel itself. Each
range also has a <code>name</code> field containing a unique identifier as a string.</p>
  </li>
  <li>
    <p><code>Kernel.alloc(size)</code>: allocate <code>size</code> bytes of kernel memory, rounded up to
a multiple of the kernel’s page size. The returned value is a <code>UInt64</code>
specifying the base address of the allocation.</p>
  </li>
  <li>
    <p><code>Kernel.protect(address, size, protection)</code>: update protection on a region
of kernel memory, where <code>protection</code> is a string of the same format as
<code>Kernel.enumerateRanges()</code>.</p>

    <p>For example:</p>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="nx">Kernel</span><span class="p">.</span><span class="nx">protect</span><span class="p">(</span><span class="nx">UInt64</span><span class="p">(</span><span class="s1">'0x1234'</span><span class="p">),</span> <span class="mi">4096</span><span class="p">,</span> <span class="s1">'rw-'</span><span class="p">);</span></code></pre></figure>

<ul>
  <li>
    <p><code>Kernel.readByteArray(address, length)</code>: just like
<code>NativePointer#readByteArray</code>, but reading from kernel memory.</p>
  </li>
  <li>
    <p><code>Kernel.writeByteArray(address, bytes)</code>: just like
<code>NativePointer#writeByteArray</code>, but writing to kernel memory.</p>
  </li>
  <li>
    <p><code>Kernel.scan(address, size, pattern, callbacks)</code>: just like <code>Memory.scan</code>,
but scanning kernel memory.</p>
  </li>
  <li>
    <p><code>Kernel.scanSync(address, size, pattern)</code>: synchronous version of <code>scan()</code>
that returns the matches in an array.</p>
  </li>
</ul>

<h2 id="objc">ObjC</h2>

<ul>
  <li>
    <p><code>ObjC.available</code>: a boolean specifying whether the current process has an
Objective-C runtime loaded. Do not invoke any other <code>ObjC</code> properties or
methods unless this is the case.</p>
  </li>
  <li>
    <p><code>ObjC.api</code>: an object mapping function names to <code>NativeFunction</code> instances
for direct access to a big portion of the Objective-C runtime API.</p>
  </li>
  <li>
    <p><code>ObjC.classes</code>: an object mapping class names to <code>ObjC.Object</code> JavaScript
bindings for each of the currently registered classes. You can interact with objects by using dot notation and replacing colons with underscores, i.e.: <code>[NSString stringWithString:@"Hello World"]</code> becomes <code>var NSString = ObjC.classes.NSString; NSString.stringWithString_("Hello World");</code>. Note the underscore after the method name. Refer to iOS Examples section for more details.</p>
  </li>
  <li>
    <p><code>ObjC.protocols</code>: an object mapping protocol names to <code>ObjC.Protocol</code>
JavaScript bindings for each of the currently registered protocols.</p>
  </li>
  <li>
    <p><code>ObjC.mainQueue</code>: the GCD queue of the main thread</p>
  </li>
  <li>
    <p><code>ObjC.schedule(queue, work)</code>: schedule the JavaScript function <code>work</code> on
the GCD queue specified by <code>queue</code>. An <code>NSAutoreleasePool</code> is created just
before calling <code>work</code>, and cleaned up on return.</p>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kd">var</span> <span class="nx">NSSound</span> <span class="o">=</span> <span class="nx">ObjC</span><span class="p">.</span><span class="nx">classes</span><span class="p">.</span><span class="nx">NSSound</span><span class="p">;</span> <span class="cm">/* macOS */</span>
<span class="nx">ObjC</span><span class="p">.</span><span class="nx">schedule</span><span class="p">(</span><span class="nx">ObjC</span><span class="p">.</span><span class="nx">mainQueue</span><span class="p">,</span> <span class="kd">function</span> <span class="p">()</span> <span class="p">{</span>
    <span class="kd">var</span> <span class="nx">sound</span> <span class="o">=</span> <span class="nx">NSSound</span><span class="p">.</span><span class="nx">alloc</span><span class="p">().</span><span class="nx">initWithContentsOfFile_byReference_</span><span class="p">(</span><span class="s2">"/Users/oleavr/.Trash/test.mp3"</span><span class="p">,</span> <span class="kc">true</span><span class="p">);</span>
    <span class="nx">sound</span><span class="p">.</span><span class="nx">play</span><span class="p">();</span>
<span class="p">});</span></code></pre></figure>

<ul>
  <li><code>new ObjC.Object(handle[, protocol])</code>: create a JavaScript binding given
the existing object at <code>handle</code> (a NativePointer). You may also specify
the <code>protocol</code> argument if you’d like to treat <code>handle</code> as an object
implementing a certain protocol only.</li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="nx">Interceptor</span><span class="p">.</span><span class="nx">attach</span><span class="p">(</span><span class="nx">myFunction</span><span class="p">.</span><span class="nx">implementation</span><span class="p">,</span> <span class="p">{</span>
  <span class="nx">onEnter</span><span class="o">:</span> <span class="kd">function</span><span class="p">(</span><span class="nx">args</span><span class="p">)</span> <span class="p">{</span>
    <span class="c1">// ObjC: args[0] = self, args[1] = selector, args[2-n] = arguments</span>
    <span class="kd">var</span> <span class="nx">myString</span> <span class="o">=</span> <span class="k">new</span> <span class="nx">ObjC</span><span class="p">.</span><span class="nb">Object</span><span class="p">(</span><span class="nx">args</span><span class="p">[</span><span class="mi">2</span><span class="p">]);</span>
    <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s2">"String argument: "</span> <span class="o">+</span> <span class="nx">myString</span><span class="p">.</span><span class="nx">toString</span><span class="p">());</span>
  <span class="p">}</span>
<span class="p">});</span></code></pre></figure>

<blockquote>
  <p>This object has some special properties:</p>

  <ul>
    <li><code>$kind</code>: string specifying either <code>instance</code>, <code>class</code> or <code>meta-class</code></li>
    <li><code>$super</code>: an <em>ObjC.Object</em> instance used for chaining up to super-class
method implementations</li>
    <li><code>$superClass</code>: super-class as an <em>ObjC.Object</em> instance</li>
    <li><code>$class</code>: class of this object as an <em>ObjC.Object</em> instance</li>
    <li><code>$className</code>: string containing the class name of this object</li>
    <li><code>$moduleName</code>: string containing the module path of this object</li>
    <li><code>$protocols</code>: object mapping protocol name to <code>ObjC.Protocol</code> instance
for each of the protocols that this object conforms to</li>
    <li><code>$methods</code>: array containing native method names exposed by this object’s
class and parent classes</li>
    <li><code>$ownMethods</code>: array containing native method names exposed by this object’s
class, not including parent classes</li>
    <li><code>$ivars</code>: object mapping each instance variable name to its current
value, allowing you to read and write each through access and assignment</li>
  </ul>

  <p>There is also an <code>equals(other)</code> method for checking whether two instances
  refer to the same underlying object.</p>
</blockquote>

<ul>
  <li>
    <p><code>new ObjC.Protocol(handle)</code>: create a JavaScript binding given the existing
protocol at <code>handle</code> (a NativePointer).</p>
  </li>
  <li>
    <p><code>new ObjC.Block(target)</code>: create a JavaScript binding given the existing
block at <code>target</code> (a NativePointer), or, to define a new block, <code>target</code>
should be an object specifying the type signature and JavaScript function to
call whenever the block is invoked. The function is specified with an
<code>implementation</code> key, and the signature is specified either through a
<code>types</code> key, or through the <code>retType</code> and <code>argTypes</code> keys. See
<code>ObjC.registerClass()</code> for details.</p>

    <p>The most common use-case is hooking an existing block, which for a block
expecting two arguments would look something like:</p>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kr">const</span> <span class="nx">pendingBlocks</span> <span class="o">=</span> <span class="k">new</span> <span class="nx">Set</span><span class="p">();</span>

<span class="nx">Interceptor</span><span class="p">.</span><span class="nx">attach</span><span class="p">(...,</span> <span class="p">{</span>
  <span class="nx">onEnter</span><span class="p">(</span><span class="nx">args</span><span class="p">)</span> <span class="p">{</span>
    <span class="kr">const</span> <span class="nx">block</span> <span class="o">=</span> <span class="k">new</span> <span class="nx">ObjC</span><span class="p">.</span><span class="nx">Block</span><span class="p">(</span><span class="nx">args</span><span class="p">[</span><span class="mi">4</span><span class="p">]);</span>
    <span class="nx">pendingBlocks</span><span class="p">.</span><span class="nx">add</span><span class="p">(</span><span class="nx">block</span><span class="p">);</span> <span class="c1">// Keep it alive</span>
    <span class="kr">const</span> <span class="nx">appCallback</span> <span class="o">=</span> <span class="nx">block</span><span class="p">.</span><span class="nx">implementation</span><span class="p">;</span>
    <span class="nx">block</span><span class="p">.</span><span class="nx">implementation</span> <span class="o">=</span> <span class="p">(</span><span class="nx">error</span><span class="p">,</span> <span class="nx">value</span><span class="p">)</span> <span class="p">=&gt;</span> <span class="p">{</span>
      <span class="c1">// Do your logging here</span>
      <span class="kr">const</span> <span class="nx">result</span> <span class="o">=</span> <span class="nx">appCallback</span><span class="p">(</span><span class="nx">error</span><span class="p">,</span> <span class="nx">value</span><span class="p">);</span>
      <span class="nx">pendingBlocks</span><span class="p">.</span><span class="k">delete</span><span class="p">(</span><span class="nx">block</span><span class="p">);</span>
      <span class="k">return</span> <span class="nx">result</span><span class="p">;</span>
    <span class="p">};</span>
  <span class="p">}</span>
<span class="p">});</span></code></pre></figure>

<ul>
  <li><code>ObjC.implement(method, fn)</code>: create a JavaScript implementation compatible
with the signature of <code>method</code>, where the JavaScript function <code>fn</code> is used
as the implementation. Returns a <code>NativeCallback</code> that you may assign to an
ObjC method’s <code>implementation</code> property.</li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kd">var</span> <span class="nx">NSSound</span> <span class="o">=</span> <span class="nx">ObjC</span><span class="p">.</span><span class="nx">classes</span><span class="p">.</span><span class="nx">NSSound</span><span class="p">;</span> <span class="cm">/* macOS */</span>
<span class="kd">var</span> <span class="nx">oldImpl</span> <span class="o">=</span> <span class="nx">NSSound</span><span class="p">.</span><span class="nx">play</span><span class="p">.</span><span class="nx">implementation</span><span class="p">;</span>
<span class="nx">NSSound</span><span class="p">.</span><span class="nx">play</span><span class="p">.</span><span class="nx">implementation</span> <span class="o">=</span> <span class="nx">ObjC</span><span class="p">.</span><span class="nx">implement</span><span class="p">(</span><span class="nx">NSSound</span><span class="p">.</span><span class="nx">play</span><span class="p">,</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">handle</span><span class="p">,</span> <span class="nx">selector</span><span class="p">)</span> <span class="p">{</span>
  <span class="k">return</span> <span class="nx">oldImpl</span><span class="p">(</span><span class="nx">handle</span><span class="p">,</span> <span class="nx">selector</span><span class="p">);</span>
<span class="p">});</span>

<span class="kd">var</span> <span class="nx">NSView</span> <span class="o">=</span> <span class="nx">ObjC</span><span class="p">.</span><span class="nx">classes</span><span class="p">.</span><span class="nx">NSView</span><span class="p">;</span> <span class="cm">/* macOS */</span>
<span class="kd">var</span> <span class="nx">drawRect</span> <span class="o">=</span> <span class="nx">NSView</span><span class="p">[</span><span class="s1">'- drawRect:'</span><span class="p">];</span>
<span class="kd">var</span> <span class="nx">oldImpl</span> <span class="o">=</span> <span class="nx">drawRect</span><span class="p">.</span><span class="nx">implementation</span><span class="p">;</span>
<span class="nx">drawRect</span><span class="p">.</span><span class="nx">implementation</span> <span class="o">=</span> <span class="nx">ObjC</span><span class="p">.</span><span class="nx">implement</span><span class="p">(</span><span class="nx">drawRect</span><span class="p">,</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">handle</span><span class="p">,</span> <span class="nx">selector</span><span class="p">)</span> <span class="p">{</span>
  <span class="nx">oldImpl</span><span class="p">(</span><span class="nx">handle</span><span class="p">,</span> <span class="nx">selector</span><span class="p">);</span>
<span class="p">});</span></code></pre></figure>

<blockquote>
  <p>As the <code>implementation</code> property is a <code>NativeFunction</code> and thus also a
  <code>NativePointer</code>, you may also use <code>Interceptor</code> to hook functions:</p>
</blockquote>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kd">var</span> <span class="nx">NSSound</span> <span class="o">=</span> <span class="nx">ObjC</span><span class="p">.</span><span class="nx">classes</span><span class="p">.</span><span class="nx">NSSound</span><span class="p">;</span> <span class="cm">/* macOS */</span>
<span class="nx">Interceptor</span><span class="p">.</span><span class="nx">attach</span><span class="p">(</span><span class="nx">NSSound</span><span class="p">.</span><span class="nx">play</span><span class="p">.</span><span class="nx">implementation</span><span class="p">,</span> <span class="p">{</span>
    <span class="nx">onEnter</span><span class="o">:</span> <span class="kd">function</span> <span class="p">()</span> <span class="p">{</span>
        <span class="nx">send</span><span class="p">(</span><span class="s2">"[NSSound play]"</span><span class="p">);</span>
    <span class="p">}</span>
<span class="p">});</span></code></pre></figure>

<ul>
  <li>
    <p><code>ObjC.registerProxy(properties)</code>: create a new class designed to act as a
proxy for a target object, where <code>properties</code> is an object specifying:</p>

    <ul>
      <li><code>protocols</code>: (optional) Array of protocols this class conforms to.</li>
      <li><code>methods</code>: (optional) Object specifying methods to implement.</li>
      <li><code>events</code>: (optional) Object specifying callbacks for getting notified
about events:
        <ul>
          <li><code>dealloc: function ()</code>: Called right after the object has been
deallocated. This is where you might clean up any associated state.</li>
          <li><code>forward: function (name)</code>: Called with <code>name</code> specifying the
method name that we’re about to forward a call to. This might be
where you’d start out with a temporary callback that just logs the
names to help you decide which methods to override.</li>
        </ul>
      </li>
    </ul>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kr">const</span> <span class="nx">MyConnectionDelegateProxy</span> <span class="o">=</span> <span class="nx">ObjC</span><span class="p">.</span><span class="nx">registerProxy</span><span class="p">({</span>
  <span class="nx">protocols</span><span class="o">:</span> <span class="p">[</span><span class="nx">ObjC</span><span class="p">.</span><span class="nx">protocols</span><span class="p">.</span><span class="nx">NSURLConnectionDataDelegate</span><span class="p">],</span>
  <span class="nx">methods</span><span class="o">:</span> <span class="p">{</span>
    <span class="s1">'- connection:didReceiveResponse:'</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">conn</span><span class="p">,</span> <span class="nx">resp</span><span class="p">)</span> <span class="p">{</span>
      <span class="cm">/* fancy logging code here */</span>
      <span class="cm">/* this.data.foo === 1234 */</span>
      <span class="k">this</span><span class="p">.</span><span class="nx">data</span><span class="p">.</span><span class="nx">target</span>
          <span class="p">.</span><span class="nx">connection_didReceiveResponse_</span><span class="p">(</span><span class="nx">conn</span><span class="p">,</span> <span class="nx">resp</span><span class="p">);</span>
    <span class="p">},</span>
    <span class="s1">'- connection:didReceiveData:'</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">conn</span><span class="p">,</span> <span class="nx">data</span><span class="p">)</span> <span class="p">{</span>
      <span class="cm">/* other logging code here */</span>
      <span class="k">this</span><span class="p">.</span><span class="nx">data</span><span class="p">.</span><span class="nx">target</span>
          <span class="p">.</span><span class="nx">connection_didReceiveData_</span><span class="p">(</span><span class="nx">conn</span><span class="p">,</span> <span class="nx">data</span><span class="p">);</span>
    <span class="p">}</span>
  <span class="p">},</span>
  <span class="nx">events</span><span class="o">:</span> <span class="p">{</span>
    <span class="nx">forward</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">name</span><span class="p">)</span> <span class="p">{</span>
      <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'*** forwarding: '</span> <span class="o">+</span> <span class="nx">name</span><span class="p">);</span>
    <span class="p">}</span>
  <span class="p">}</span>
<span class="p">});</span>

<span class="kr">const</span> <span class="nx">method</span> <span class="o">=</span> <span class="nx">ObjC</span><span class="p">.</span><span class="nx">classes</span><span class="p">.</span><span class="nx">NSURLConnection</span><span class="p">[</span>
    <span class="s1">'- initWithRequest:delegate:startImmediately:'</span><span class="p">];</span>
<span class="nx">Interceptor</span><span class="p">.</span><span class="nx">attach</span><span class="p">(</span><span class="nx">method</span><span class="p">.</span><span class="nx">implementation</span><span class="p">,</span> <span class="p">{</span>
  <span class="nx">onEnter</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">args</span><span class="p">)</span> <span class="p">{</span>
    <span class="nx">args</span><span class="p">[</span><span class="mi">3</span><span class="p">]</span> <span class="o">=</span> <span class="k">new</span> <span class="nx">MyConnectionDelegateProxy</span><span class="p">(</span><span class="nx">args</span><span class="p">[</span><span class="mi">3</span><span class="p">],</span> <span class="p">{</span>
      <span class="nx">foo</span><span class="o">:</span> <span class="mi">1234</span>
    <span class="p">});</span>
  <span class="p">}</span>
<span class="p">});</span></code></pre></figure>

<ul>
  <li>
    <p><code>ObjC.registerClass(properties)</code>: create a new Objective-C class, where
<code>properties</code> is an object specifying:</p>

    <ul>
      <li><code>name</code>: (optional) String specifying the name of the class; omit this
if you don’t care about the globally visible name and would like the
runtime to auto-generate one for you.</li>
      <li><code>super</code>: (optional) Super-class, or <em>null</em> to create a new root class;
omit to inherit from <em>NSObject</em>.</li>
      <li><code>protocols</code>: (optional) Array of protocols this class conforms to.</li>
      <li><code>methods</code>: (optional) Object specifying methods to implement.</li>
    </ul>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kr">const</span> <span class="nx">MyConnectionDelegateProxy</span> <span class="o">=</span> <span class="nx">ObjC</span><span class="p">.</span><span class="nx">registerClass</span><span class="p">({</span>
  <span class="nx">name</span><span class="o">:</span> <span class="s1">'MyConnectionDelegateProxy'</span><span class="p">,</span>
  <span class="kr">super</span><span class="o">:</span> <span class="nx">ObjC</span><span class="p">.</span><span class="nx">classes</span><span class="p">.</span><span class="nx">NSObject</span><span class="p">,</span>
  <span class="nx">protocols</span><span class="o">:</span> <span class="p">[</span><span class="nx">ObjC</span><span class="p">.</span><span class="nx">protocols</span><span class="p">.</span><span class="nx">NSURLConnectionDataDelegate</span><span class="p">],</span>
  <span class="nx">methods</span><span class="o">:</span> <span class="p">{</span>
    <span class="s1">'- init'</span><span class="o">:</span> <span class="kd">function</span> <span class="p">()</span> <span class="p">{</span>
      <span class="kr">const</span> <span class="nx">self</span> <span class="o">=</span> <span class="k">this</span><span class="p">.</span><span class="kr">super</span><span class="p">.</span><span class="nx">init</span><span class="p">();</span>
      <span class="k">if</span> <span class="p">(</span><span class="nx">self</span> <span class="o">!==</span> <span class="kc">null</span><span class="p">)</span> <span class="p">{</span>
        <span class="nx">ObjC</span><span class="p">.</span><span class="nx">bind</span><span class="p">(</span><span class="nx">self</span><span class="p">,</span> <span class="p">{</span>
          <span class="nx">foo</span><span class="o">:</span> <span class="mi">1234</span>
        <span class="p">});</span>
      <span class="p">}</span>
      <span class="k">return</span> <span class="nx">self</span><span class="p">;</span>
    <span class="p">},</span>
    <span class="s1">'- dealloc'</span><span class="o">:</span> <span class="kd">function</span> <span class="p">()</span> <span class="p">{</span>
      <span class="nx">ObjC</span><span class="p">.</span><span class="nx">unbind</span><span class="p">(</span><span class="k">this</span><span class="p">.</span><span class="nx">self</span><span class="p">);</span>
      <span class="k">this</span><span class="p">.</span><span class="kr">super</span><span class="p">.</span><span class="nx">dealloc</span><span class="p">();</span>
    <span class="p">},</span>
    <span class="s1">'- connection:didReceiveResponse:'</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">conn</span><span class="p">,</span> <span class="nx">resp</span><span class="p">)</span> <span class="p">{</span>
      <span class="cm">/* this.data.foo === 1234 */</span>
    <span class="p">},</span>
    <span class="cm">/*</span>
<span class="cm">     * But those previous methods are declared assuming that</span>
<span class="cm">     * either the super-class or a protocol we conform to has</span>
<span class="cm">     * the same method so we can grab its type information.</span>
<span class="cm">     * However, if that's not the case, you would write it</span>
<span class="cm">     * like this:</span>
<span class="cm">     */</span>
    <span class="s1">'- connection:didReceiveResponse:'</span><span class="o">:</span> <span class="p">{</span>
      <span class="nx">retType</span><span class="o">:</span> <span class="s1">'void'</span><span class="p">,</span>
      <span class="nx">argTypes</span><span class="o">:</span> <span class="p">[</span><span class="s1">'object'</span><span class="p">,</span> <span class="s1">'object'</span><span class="p">],</span>
      <span class="nx">implementation</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">conn</span><span class="p">,</span> <span class="nx">resp</span><span class="p">)</span> <span class="p">{</span>
      <span class="p">}</span>
    <span class="p">},</span>
    <span class="cm">/* Or grab it from an existing class: */</span>
    <span class="s1">'- connection:didReceiveResponse:'</span><span class="o">:</span> <span class="p">{</span>
      <span class="nx">types</span><span class="o">:</span> <span class="nx">ObjC</span><span class="p">.</span><span class="nx">classes</span>
          <span class="p">.</span><span class="nx">Foo</span><span class="p">[</span><span class="s1">'- connection:didReceiveResponse:'</span><span class="p">].</span><span class="nx">types</span><span class="p">,</span>
      <span class="nx">implementation</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">conn</span><span class="p">,</span> <span class="nx">resp</span><span class="p">)</span> <span class="p">{</span>
      <span class="p">}</span>
    <span class="p">},</span>
    <span class="cm">/* Or from an existing protocol: */</span>
    <span class="s1">'- connection:didReceiveResponse:'</span><span class="o">:</span> <span class="p">{</span>
      <span class="nx">types</span><span class="o">:</span> <span class="nx">ObjC</span><span class="p">.</span><span class="nx">protocols</span><span class="p">.</span><span class="nx">NSURLConnectionDataDelegate</span>
          <span class="p">.</span><span class="nx">methods</span><span class="p">[</span><span class="s1">'- connection:didReceiveResponse:'</span><span class="p">].</span><span class="nx">types</span><span class="p">,</span>
      <span class="nx">implementation</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">conn</span><span class="p">,</span> <span class="nx">resp</span><span class="p">)</span> <span class="p">{</span>
      <span class="p">}</span>
    <span class="p">},</span>
    <span class="cm">/* Or write the signature by hand if you really want to: */</span>
    <span class="s1">'- connection:didReceiveResponse:'</span><span class="o">:</span> <span class="p">{</span>
      <span class="nx">types</span><span class="o">:</span> <span class="s1">'v32@0:8@16@24'</span><span class="p">,</span>
      <span class="nx">implementation</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">conn</span><span class="p">,</span> <span class="nx">resp</span><span class="p">)</span> <span class="p">{</span>
      <span class="p">}</span>
    <span class="p">}</span>
  <span class="p">}</span>
<span class="p">});</span>

<span class="kr">const</span> <span class="nx">proxy</span> <span class="o">=</span> <span class="nx">MyConnectionDelegateProxy</span><span class="p">.</span><span class="nx">alloc</span><span class="p">().</span><span class="nx">init</span><span class="p">();</span>
<span class="cm">/* use `proxy`, and later: */</span>
<span class="nx">proxy</span><span class="p">.</span><span class="nx">release</span><span class="p">();</span></code></pre></figure>

<ul>
  <li>
    <p><code>ObjC.registerProtocol(properties)</code>: create a new Objective-C protocol,
where <code>properties</code> is an object specifying:</p>

    <ul>
      <li><code>name</code>: (optional) String specifying the name of the protocol; omit this
if you don’t care about the globally visible name and would like the
runtime to auto-generate one for you.</li>
      <li><code>protocols</code>: (optional) Array of protocols this protocol incorporates.</li>
      <li><code>methods</code>: (optional) Object specifying methods to declare.</li>
    </ul>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kr">const</span> <span class="nx">MyDataDelegate</span> <span class="o">=</span> <span class="nx">ObjC</span><span class="p">.</span><span class="nx">registerProtocol</span><span class="p">({</span>
  <span class="nx">name</span><span class="o">:</span> <span class="s1">'MyDataDelegate'</span><span class="p">,</span>
  <span class="nx">protocols</span><span class="o">:</span> <span class="p">[</span><span class="nx">ObjC</span><span class="p">.</span><span class="nx">protocols</span><span class="p">.</span><span class="nx">NSURLConnectionDataDelegate</span><span class="p">],</span>
  <span class="nx">methods</span><span class="o">:</span> <span class="p">{</span>
    <span class="cm">/* You must specify the signature: */</span>
    <span class="s1">'- connection:didStuff:'</span><span class="o">:</span> <span class="p">{</span>
      <span class="nx">retType</span><span class="o">:</span> <span class="s1">'void'</span><span class="p">,</span>
      <span class="nx">argTypes</span><span class="o">:</span> <span class="p">[</span><span class="s1">'object'</span><span class="p">,</span> <span class="s1">'object'</span><span class="p">]</span>
    <span class="p">},</span>
    <span class="cm">/* Or grab it from a method of an existing class: */</span>
    <span class="s1">'- connection:didStuff:'</span><span class="o">:</span> <span class="p">{</span>
      <span class="nx">types</span><span class="o">:</span> <span class="nx">ObjC</span><span class="p">.</span><span class="nx">classes</span>
          <span class="p">.</span><span class="nx">Foo</span><span class="p">[</span><span class="s1">'- connection:didReceiveResponse:'</span><span class="p">].</span><span class="nx">types</span>
    <span class="p">},</span>
    <span class="cm">/* Or from an existing protocol method: */</span>
    <span class="s1">'- connection:didStuff:'</span><span class="o">:</span> <span class="p">{</span>
      <span class="nx">types</span><span class="o">:</span> <span class="nx">ObjC</span><span class="p">.</span><span class="nx">protocols</span><span class="p">.</span><span class="nx">NSURLConnectionDataDelegate</span>
          <span class="p">.</span><span class="nx">methods</span><span class="p">[</span><span class="s1">'- connection:didReceiveResponse:'</span><span class="p">].</span><span class="nx">types</span>
    <span class="p">},</span>
    <span class="cm">/* Or write the signature by hand if you really want to: */</span>
    <span class="s1">'- connection:didStuff:'</span><span class="o">:</span> <span class="p">{</span>
      <span class="nx">types</span><span class="o">:</span> <span class="s1">'v32@0:8@16@24'</span>
    <span class="p">},</span>
    <span class="cm">/* You can also make a method optional (default is required): */</span>
    <span class="s1">'- connection:didStuff:'</span><span class="o">:</span> <span class="p">{</span>
      <span class="nx">retType</span><span class="o">:</span> <span class="s1">'void'</span><span class="p">,</span>
      <span class="nx">argTypes</span><span class="o">:</span> <span class="p">[</span><span class="s1">'object'</span><span class="p">,</span> <span class="s1">'object'</span><span class="p">],</span>
      <span class="nx">optional</span><span class="o">:</span> <span class="kc">true</span>
    <span class="p">}</span>
  <span class="p">}</span>
<span class="p">});</span></code></pre></figure>

<ul>
  <li>
    <p><code>ObjC.bind(obj, data)</code>: bind some JavaScript data to an Objective-C
instance; see <code>ObjC.registerClass()</code> for an example.</p>
  </li>
  <li>
    <p><code>ObjC.unbind(obj)</code>: unbind previous associated JavaScript data from an
Objective-C instance; see <code>ObjC.registerClass()</code> for an example.</p>
  </li>
  <li>
    <p><code>ObjC.getBoundData(obj)</code>: look up previously bound data from an Objective-C
object.</p>
  </li>
  <li>
    <p><code>ObjC.enumerateLoadedClasses([options, ]callbacks)</code>: enumerate classes
loaded right now, where <code>callbacks</code> is an object specifying:</p>

    <ul>
      <li>
        <p><code>onMatch: function (name, owner)</code>: called for each loaded class with the
<code>name</code> of the class as a string, and <code>owner</code> specifying the path to the
module where the class was loaded from. To obtain a JavaScript wrapper
for a given class, do: <code>ObjC.classes[name]</code>.</p>
      </li>
      <li>
        <p><code>onComplete: function ()</code>: called when all classes have been enumerated.</p>
      </li>
    </ul>

    <p>For example:</p>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="nx">ObjC</span><span class="p">.</span><span class="nx">enumerateLoadedClasses</span><span class="p">({</span>
  <span class="nx">onMatch</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">name</span><span class="p">,</span> <span class="nx">owner</span><span class="p">)</span> <span class="p">{</span>
    <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'onMatch:'</span><span class="p">,</span> <span class="nx">name</span><span class="p">,</span> <span class="nx">owner</span><span class="p">);</span>
  <span class="p">},</span>
  <span class="nx">onComplete</span><span class="o">:</span> <span class="kd">function</span> <span class="p">()</span> <span class="p">{</span>
  <span class="p">}</span>
<span class="p">});</span></code></pre></figure>

<pre><code>The optional `options` argument is an object where you may specify the
`ownedBy` property to limit enumeration to modules in a given `ModuleMap`.

For example:
</code></pre>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kd">var</span> <span class="nx">appModules</span> <span class="o">=</span> <span class="k">new</span> <span class="nx">ModuleMap</span><span class="p">(</span><span class="nx">isAppModule</span><span class="p">);</span>
<span class="nx">ObjC</span><span class="p">.</span><span class="nx">enumerateLoadedClasses</span><span class="p">({</span> <span class="nx">ownedBy</span><span class="o">:</span> <span class="nx">appModules</span> <span class="p">},</span> <span class="p">{</span>
  <span class="nx">onMatch</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">name</span><span class="p">,</span> <span class="nx">owner</span><span class="p">)</span> <span class="p">{</span>
    <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'onMatch:'</span><span class="p">,</span> <span class="nx">name</span><span class="p">,</span> <span class="nx">owner</span><span class="p">);</span>
  <span class="p">},</span>
  <span class="nx">onComplete</span><span class="o">:</span> <span class="kd">function</span> <span class="p">()</span> <span class="p">{</span>
  <span class="p">}</span>
<span class="p">});</span>

<span class="kd">function</span> <span class="nx">isAppModule</span><span class="p">(</span><span class="nx">m</span><span class="p">)</span> <span class="p">{</span>
  <span class="k">return</span> <span class="o">!</span><span class="sr">/^\/(usr\/lib|System|Developer)\//</span><span class="p">.</span><span class="nx">test</span><span class="p">(</span><span class="nx">m</span><span class="p">.</span><span class="nx">path</span><span class="p">);</span>
<span class="p">}</span></code></pre></figure>

<ul>
  <li>
    <p><code>ObjC.enumerateLoadedClassesSync([options])</code>: synchronous version of
<code>enumerateLoadedClasses()</code> that returns an object mapping owner module to
an array of class names.</p>

    <p>For example:</p>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kd">var</span> <span class="nx">appModules</span> <span class="o">=</span> <span class="k">new</span> <span class="nx">ModuleMap</span><span class="p">(</span><span class="nx">isAppModule</span><span class="p">);</span>
<span class="kd">var</span> <span class="nx">appClasses</span> <span class="o">=</span> <span class="nx">ObjC</span><span class="p">.</span><span class="nx">enumerateLoadedClassesSync</span><span class="p">({</span> <span class="nx">ownedBy</span><span class="o">:</span> <span class="nx">appModules</span> <span class="p">});</span>
<span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'appClasses:'</span><span class="p">,</span> <span class="nx">JSON</span><span class="p">.</span><span class="nx">stringify</span><span class="p">(</span><span class="nx">appClasses</span><span class="p">));</span>

<span class="kd">function</span> <span class="nx">isAppModule</span><span class="p">(</span><span class="nx">m</span><span class="p">)</span> <span class="p">{</span>
  <span class="k">return</span> <span class="o">!</span><span class="sr">/^\/(usr\/lib|System|Developer)\//</span><span class="p">.</span><span class="nx">test</span><span class="p">(</span><span class="nx">m</span><span class="p">.</span><span class="nx">path</span><span class="p">);</span>
<span class="p">}</span></code></pre></figure>

<ul>
  <li>
    <p><code>ObjC.choose(specifier, callbacks)</code>: enumerate live instances of classes
matching <code>specifier</code> by scanning the heap. <code>specifier</code> is either a class
selector or an object specifying a class selector and desired options.
The class selector is an <em>ObjC.Object</em> of a class, e.g.
<em>ObjC.classes.UIButton</em>.
When passing an object as the specifier you should provide the <code>class</code>
field with your class selector, and the <code>subclasses</code> field with a
boolean indicating whether you’re also interested in subclasses matching the
given class selector. The default is to also include subclasses.
The <code>callbacks</code> argument is an object specifying:</p>

    <ul>
      <li>
        <p><code>onMatch: function (instance)</code>: called once for each live instance found
with a ready-to-use <code>instance</code> just as if you would have called
<code>new ObjC.Object(ptr("0x1234"))</code> knowing that this particular
Objective-C instance lives at <em>0x1234</em>.</p>

        <p>This function may return the string <code>stop</code> to cancel the enumeration
early.</p>
      </li>
      <li>
        <p><code>onComplete: function ()</code>: called when all instances have been enumerated</p>
      </li>
    </ul>
  </li>
  <li>
    <p><code>ObjC.chooseSync(specifier)</code>: synchronous version of <code>choose()</code> that returns
the instances in an array.</p>
  </li>
  <li>
    <p><code>ObjC.selector(name)</code>: convert the JavaScript string <code>name</code> to a selector</p>
  </li>
  <li>
    <p><code>ObjC.selectorAsString(sel)</code>: convert the selector <code>sel</code> to a JavaScript
string</p>
  </li>
</ul>

<h2 id="java">Java</h2>

<ul>
  <li>
    <p><code>Java.available</code>: a boolean specifying whether the current process has the
a Java VM loaded, i.e. Dalvik or ART. Do not invoke any other <code>Java</code>
properties or methods unless this is the case.</p>
  </li>
  <li>
    <p><code>Java.androidVersion</code>: a string specifying which version of Android we’re
running on.</p>
  </li>
  <li>
    <p><code>Java.enumerateLoadedClasses(callbacks)</code>: enumerate classes loaded right
now, where <code>callbacks</code> is an object specifying:</p>

    <ul>
      <li>
        <p><code>onMatch: function (className)</code>: called for each loaded class with
<code>className</code> that may be passed to <code>use()</code> to get a JavaScript wrapper.</p>
      </li>
      <li>
        <p><code>onComplete: function ()</code>: called when all classes have been enumerated.</p>
      </li>
    </ul>
  </li>
  <li>
    <p><code>Java.enumerateLoadedClassesSync()</code>: synchronous version of
<code>enumerateLoadedClasses()</code> that returns the class names in an array.</p>
  </li>
  <li>
    <p><code>Java.enumerateClassLoaders(callbacks)</code>: enumerate class loaders present
in the Java VM, where <code>callbacks</code> is an object specifying:</p>

    <ul>
      <li>
        <p><code>onMatch: function (loader)</code>: called for each class loader with
<code>loader</code>, a wrapper for the specific <code>java.lang.ClassLoader</code>.</p>
      </li>
      <li>
        <p><code>onComplete: function ()</code>: called when all class loaders have been
enumerated.</p>
      </li>
    </ul>

    <p>You may assign such a loader to <code>Java.classFactory.loader</code> to make
<code>Java.use()</code> look for classes on a specific loader instead of the default
loader used by the app.</p>
  </li>
  <li>
    <p><code>Java.enumerateClassLoadersSync()</code>: synchronous version of
<code>enumerateClassLoaders()</code> that returns the class loaders in an array.</p>
  </li>
  <li>
    <p><code>Java.scheduleOnMainThread(fn)</code>: run <code>fn</code> on the main thread of the VM.</p>
  </li>
  <li>
    <p><code>Java.perform(fn)</code>: ensure that the current thread is attached to the VM
and call <code>fn</code>. (This isn’t necessary in callbacks from Java.)
Will defer calling <code>fn</code> if the app’s class loader is not available yet.
Use <code>Java.performNow()</code> if access to the app’s classes is not needed.</p>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="nx">Java</span><span class="p">.</span><span class="nx">perform</span><span class="p">(</span><span class="kd">function</span> <span class="p">()</span> <span class="p">{</span>
  <span class="kd">var</span> <span class="nx">Activity</span> <span class="o">=</span> <span class="nx">Java</span><span class="p">.</span><span class="nx">use</span><span class="p">(</span><span class="s1">'android.app.Activity'</span><span class="p">);</span>
  <span class="nx">Activity</span><span class="p">.</span><span class="nx">onResume</span><span class="p">.</span><span class="nx">implementation</span> <span class="o">=</span> <span class="kd">function</span> <span class="p">()</span> <span class="p">{</span>
    <span class="nx">send</span><span class="p">(</span><span class="s1">'onResume() got called! Let\'s call the original implementation'</span><span class="p">);</span>
    <span class="k">this</span><span class="p">.</span><span class="nx">onResume</span><span class="p">();</span>
  <span class="p">};</span>
<span class="p">});</span></code></pre></figure>

<ul>
  <li>
    <p><code>Java.performNow(fn)</code>: ensure that the current thread is attached to the
VM and call <code>fn</code>. (This isn’t necessary in callbacks from Java.)</p>
  </li>
  <li>
    <p><code>Java.use(className)</code>: dynamically get a JavaScript wrapper for
<code>className</code> that you can instantiate objects from by calling <code>$new()</code> on
it to invoke a constructor. Call <code>$dispose()</code> on an instance to clean it
up explicitly (or wait for the JavaScript object to get garbage-collected,
or script to get unloaded). Static and non-static methods are available,
and you can even replace a method implementation and throw an exception
from it:</p>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="nx">Java</span><span class="p">.</span><span class="nx">perform</span><span class="p">(</span><span class="kd">function</span> <span class="p">()</span> <span class="p">{</span>
  <span class="kd">var</span> <span class="nx">Activity</span> <span class="o">=</span> <span class="nx">Java</span><span class="p">.</span><span class="nx">use</span><span class="p">(</span><span class="s1">'android.app.Activity'</span><span class="p">);</span>
  <span class="kd">var</span> <span class="nx">Exception</span> <span class="o">=</span> <span class="nx">Java</span><span class="p">.</span><span class="nx">use</span><span class="p">(</span><span class="s1">'java.lang.Exception'</span><span class="p">);</span>
  <span class="nx">Activity</span><span class="p">.</span><span class="nx">onResume</span><span class="p">.</span><span class="nx">implementation</span> <span class="o">=</span> <span class="kd">function</span> <span class="p">()</span> <span class="p">{</span>
    <span class="k">throw</span> <span class="nx">Exception</span><span class="p">.</span><span class="nx">$new</span><span class="p">(</span><span class="s1">'Oh noes!'</span><span class="p">);</span>
  <span class="p">};</span>
<span class="p">});</span></code></pre></figure>

<pre><code>Uses the app's class loader by default, but you may customize this by
assigning a different loader instance to `Java.classFactory.loader`.
</code></pre>

<ul>
  <li>
    <p><code>Java.use(className, { cache: 'skip' })</code>: just like the above, but skipping
the class wrapper cache. Useful when dealing with multiple class-loaders
and colliding class names.</p>
  </li>
  <li>
    <p><code>Java.openClassFile(filePath)</code>: open the .dex file at <code>filePath</code>, returning
an object with the following methods:</p>

    <ul>
      <li>
        <p><code>load()</code>: load the contained classes into the VM.</p>
      </li>
      <li>
        <p><code>getClassNames()</code>: obtain an array of available class names.</p>
      </li>
    </ul>
  </li>
  <li>
    <p><code>Java.choose(className, callbacks)</code>: enumerate live instances of the
<code>className</code> class by scanning the Java heap, where <code>callbacks</code> is an
object specifying:</p>

    <ul>
      <li>
        <p><code>onMatch: function (instance)</code>: called with each live instance found
with a ready-to-use <code>instance</code> just as if you would have called
<code>Java.cast()</code> with a raw handle to this particular instance.</p>

        <p>This function may return the string <code>stop</code> to cancel the enumeration
early.</p>
      </li>
      <li>
        <p><code>onComplete: function ()</code>: called when all instances have been enumerated</p>
      </li>
    </ul>
  </li>
  <li>
    <p><code>Java.retain(obj)</code>: duplicates the JavaScript wrapper <code>obj</code> for later use
outside replacement method.</p>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="nx">Java</span><span class="p">.</span><span class="nx">perform</span><span class="p">(</span><span class="kd">function</span> <span class="p">()</span> <span class="p">{</span>
  <span class="kd">var</span> <span class="nx">Activity</span> <span class="o">=</span> <span class="nx">Java</span><span class="p">.</span><span class="nx">use</span><span class="p">(</span><span class="s1">'android.app.Activity'</span><span class="p">);</span>
  <span class="kd">var</span> <span class="nx">lastActivity</span> <span class="o">=</span> <span class="kc">null</span><span class="p">;</span>
  <span class="nx">Activity</span><span class="p">.</span><span class="nx">onResume</span><span class="p">.</span><span class="nx">implementation</span> <span class="o">=</span> <span class="kd">function</span> <span class="p">()</span> <span class="p">{</span>
    <span class="nx">lastActivity</span> <span class="o">=</span> <span class="nx">Java</span><span class="p">.</span><span class="nx">retain</span><span class="p">(</span><span class="k">this</span><span class="p">);</span>
    <span class="k">this</span><span class="p">.</span><span class="nx">onResume</span><span class="p">();</span>
  <span class="p">};</span>
<span class="p">});</span></code></pre></figure>

<ul>
  <li><code>Java.cast(handle, klass)</code>: create a JavaScript wrapper given the existing
instance at <code>handle</code> of given class <code>klass</code> as returned from <code>Java.use()</code>.
Such a wrapper also has a <code>class</code> property for getting a wrapper for its
class, and a <code>$className</code> property for getting a string representation of
its class-name.</li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kd">var</span> <span class="nx">Activity</span> <span class="o">=</span> <span class="nx">Java</span><span class="p">.</span><span class="nx">use</span><span class="p">(</span><span class="s1">'android.app.Activity'</span><span class="p">);</span>
<span class="kd">var</span> <span class="nx">activity</span> <span class="o">=</span> <span class="nx">Java</span><span class="p">.</span><span class="nx">cast</span><span class="p">(</span><span class="nx">ptr</span><span class="p">(</span><span class="s1">'0x1234'</span><span class="p">),</span> <span class="nx">Activity</span><span class="p">);</span></code></pre></figure>

<ul>
  <li><code>Java.array(type, elements)</code>: creates a Java array with elements of the
 specified <code>type</code>, from a JavaScript array <code>elements</code>. The resulting Java
 array behaves like a JS array, but can be passed by reference to Java APIs
 in order to allow them to modify its contents.</li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kd">var</span> <span class="nx">values</span> <span class="o">=</span> <span class="nx">Java</span><span class="p">.</span><span class="nx">array</span><span class="p">(</span><span class="s1">'int'</span><span class="p">,</span> <span class="p">[</span> <span class="mi">1003</span><span class="p">,</span> <span class="mi">1005</span><span class="p">,</span> <span class="mi">1007</span> <span class="p">]);</span>

<span class="kd">var</span> <span class="nx">JString</span> <span class="o">=</span> <span class="nx">Java</span><span class="p">.</span><span class="nx">use</span><span class="p">(</span><span class="s1">'java.lang.String'</span><span class="p">);</span>
<span class="kd">var</span> <span class="nx">str</span> <span class="o">=</span> <span class="nx">JString</span><span class="p">.</span><span class="nx">$new</span><span class="p">(</span><span class="nx">Java</span><span class="p">.</span><span class="nx">array</span><span class="p">(</span><span class="s1">'byte'</span><span class="p">,</span> <span class="p">[</span> <span class="mh">0x48</span><span class="p">,</span> <span class="mh">0x65</span><span class="p">,</span> <span class="mh">0x69</span> <span class="p">]));</span></code></pre></figure>

<ul>
  <li>
    <p><code>Java.isMainThread()</code>: determine whether the caller is running on the main
thread.</p>
  </li>
  <li>
    <p><code>Java.registerClass(spec)</code>: create a new Java class and return a wrapper for
it, where <code>spec</code> is an object containing:</p>

    <ul>
      <li><code>name</code>: String specifying the name of the class.</li>
      <li><code>superClass</code>: (optional) Super-class. Omit to inherit from
              <code>java.lang.Object</code>.</li>
      <li><code>implements</code>: (optional) Array of interfaces implemented by this class.</li>
      <li><code>fields</code>: (optional) Object specifying the name and type of each field
          to expose.</li>
      <li><code>methods</code>: (optional) Object specifying methods to implement.</li>
    </ul>
  </li>
</ul>

<figure class="highlight"><pre><code class="language-js" data-lang="js"><span></span><span class="kd">var</span> <span class="nx">SomeBaseClass</span> <span class="o">=</span> <span class="nx">Java</span><span class="p">.</span><span class="nx">use</span><span class="p">(</span><span class="s1">'com.example.SomeBaseClass'</span><span class="p">);</span>
<span class="kd">var</span> <span class="nx">X509TrustManager</span> <span class="o">=</span> <span class="nx">Java</span><span class="p">.</span><span class="nx">use</span><span class="p">(</span><span class="s1">'javax.net.ssl.X509TrustManager'</span><span class="p">);</span>

<span class="kd">var</span> <span class="nx">MyTrustManager</span> <span class="o">=</span> <span class="nx">Java</span><span class="p">.</span><span class="nx">registerClass</span><span class="p">({</span>
  <span class="nx">name</span><span class="o">:</span> <span class="s1">'com.example.MyTrustManager'</span><span class="p">,</span>
  <span class="kr">implements</span><span class="o">:</span> <span class="p">[</span><span class="nx">X509TrustManager</span><span class="p">],</span>
  <span class="nx">methods</span><span class="o">:</span> <span class="p">{</span>
    <span class="nx">checkClientTrusted</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">chain</span><span class="p">,</span> <span class="nx">authType</span><span class="p">)</span> <span class="p">{</span>
    <span class="p">},</span>
    <span class="nx">checkServerTrusted</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">chain</span><span class="p">,</span> <span class="nx">authType</span><span class="p">)</span> <span class="p">{</span>
    <span class="p">},</span>
    <span class="nx">getAcceptedIssuers</span><span class="o">:</span> <span class="kd">function</span> <span class="p">()</span> <span class="p">{</span>
      <span class="k">return</span> <span class="p">[];</span>
    <span class="p">},</span>
  <span class="p">}</span>
<span class="p">});</span>

<span class="kd">var</span> <span class="nx">MyWeirdTrustManager</span> <span class="o">=</span> <span class="nx">Java</span><span class="p">.</span><span class="nx">registerClass</span><span class="p">({</span>
  <span class="nx">name</span><span class="o">:</span> <span class="s1">'com.example.MyWeirdTrustManager'</span><span class="p">,</span>
  <span class="nx">superClass</span><span class="o">:</span> <span class="nx">SomeBaseClass</span><span class="p">,</span>
  <span class="kr">implements</span><span class="o">:</span> <span class="p">[</span><span class="nx">X509TrustManager</span><span class="p">],</span>
  <span class="nx">fields</span><span class="o">:</span> <span class="p">{</span>
    <span class="nx">description</span><span class="o">:</span> <span class="s1">'java.lang.String'</span><span class="p">,</span>
    <span class="nx">limit</span><span class="o">:</span> <span class="s1">'int'</span><span class="p">,</span>
  <span class="p">},</span>
  <span class="nx">methods</span><span class="o">:</span> <span class="p">{</span>
    <span class="nx">$init</span><span class="o">:</span> <span class="kd">function</span> <span class="p">()</span> <span class="p">{</span>
      <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'Constructor called'</span><span class="p">);</span>
    <span class="p">},</span>
    <span class="nx">checkClientTrusted</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">chain</span><span class="p">,</span> <span class="nx">authType</span><span class="p">)</span> <span class="p">{</span>
      <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'checkClientTrusted'</span><span class="p">);</span>
    <span class="p">},</span>
    <span class="nx">checkServerTrusted</span><span class="o">:</span> <span class="p">[{</span>
      <span class="nx">returnType</span><span class="o">:</span> <span class="s1">'void'</span><span class="p">,</span>
      <span class="nx">argumentTypes</span><span class="o">:</span> <span class="p">[</span><span class="s1">'[Ljava.security.cert.X509Certificate;'</span><span class="p">,</span> <span class="s1">'java.lang.String'</span><span class="p">],</span>
      <span class="nx">implementation</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">chain</span><span class="p">,</span> <span class="nx">authType</span><span class="p">)</span> <span class="p">{</span>
        <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'checkServerTrusted A'</span><span class="p">);</span>
      <span class="p">}</span>
    <span class="p">},</span> <span class="p">{</span>
      <span class="nx">returnType</span><span class="o">:</span> <span class="s1">'java.util.List'</span><span class="p">,</span>
      <span class="nx">argumentTypes</span><span class="o">:</span> <span class="p">[</span><span class="s1">'[Ljava.security.cert.X509Certificate;'</span><span class="p">,</span> <span class="s1">'java.lang.String'</span><span class="p">,</span> <span class="s1">'java.lang.String'</span><span class="p">],</span>
      <span class="nx">implementation</span><span class="o">:</span> <span class="kd">function</span> <span class="p">(</span><span class="nx">chain</span><span class="p">,</span> <span class="nx">authType</span><span class="p">,</span> <span class="nx">host</span><span class="p">)</span> <span class="p">{</span>
        <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'checkServerTrusted B'</span><span class="p">);</span>
        <span class="k">return</span> <span class="kc">null</span><span class="p">;</span>
      <span class="p">}</span>
    <span class="p">}],</span>
    <span class="nx">getAcceptedIssuers</span><span class="o">:</span> <span class="kd">function</span> <span class="p">()</span> <span class="p">{</span>
      <span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="s1">'getAcceptedIssuers'</span><span class="p">);</span>
      <span class="k">return</span> <span class="p">[];</span>
    <span class="p">},</span>
  <span class="p">}</span>
<span class="p">});</span></code></pre></figure>

<ul>
  <li>
    <p><code>Java.deoptimizeEverything()</code>: forces the VM to execute everything with
its interpreter. Necessary to prevent optimizations from bypassing method
hooks in some cases, and allows ART’s Instrumentation APIs to be used for
tracing the runtime.</p>
  </li>
  <li>
    <p><code>Java.vm</code>: object with the following methods:</p>

    <ul>
      <li>
        <p><code>perform(fn)</code>: ensures that the current thread is attached to the VM and
calls <code>fn</code>. (This isn’t necessary in callbacks from Java.)</p>
      </li>
      <li>
        <p><code>getEnv()</code>: gets a wrapper for the current thread’s <code>JNIEnv</code>. Throws an
exception if the current thread is not attached to the VM.</p>
      </li>
      <li>
        <p><code>tryGetEnv()</code>: tries to get a wrapper for the current thread’s <code>JNIEnv</code>.
Returns <code>null</code> if the current thread is not attached to the VM.</p>
      </li>
    </ul>
  </li>
  <li>
    <p><code>Java.classFactory</code>: object with the following properties:</p>

    <ul>
      <li>
        <p><code>loader</code>: wrapper for the class loader currently being used. Typically
updated by the first call to <code>Java.perform()</code>.</p>

        <p>You may assign a different <code>java.lang.ClassLoader</code> to make <code>Java.use()</code>
look for classes on a specific loader instead of the default loader used
by the app.</p>
      </li>
      <li>
        <p><code>cacheDir</code>: string containing path to cache directory currently being
used. Typically updated by the first call to <code>Java.perform()</code>.</p>
      </li>
      <li>
        <p><code>tempFileNaming</code>: object specifying naming convention to use for
temporary files. Defaults to <code>{ prefix: 'frida', suffix: 'dat' }</code>.</p>
      </li>
    </ul>
  </li>
</ul>

<h2 id="weakref">WeakRef</h2>

<ul>
  <li>
    <p><code>WeakRef.bind(value, fn)</code>: monitor <code>value</code> and call the <code>fn</code> callback as
soon as <code>value</code> has been garbage-collected, or the script is about to get
unloaded. Returns an id that you can pass to <code>WeakRef.unbind()</code> for
explicit cleanup.</p>

    <p>This API is useful if you’re building a language-binding, where you need to
free native resources when a JS value is no longer needed.</p>
  </li>
  <li>
    <p><code>WeakRef.unbind(id)</code>: stop monitoring the value passed to
<code>WeakRef.bind(value, fn)</code>, and call the <code>fn</code> callback immediately.</p>
  </li>
</ul>

<h2 id="x86writer">X86Writer</h2>

<ul>
  <li>
    <p><code>new X86Writer(codeAddress[, { pc: ptr('0x1234') }])</code>: create a new code
writer for generating x86 machine code written directly to memory at
<code>codeAddress</code>, specified as a NativePointer.
The second argument is an optional options object where the initial program
counter may be specified, which is useful when generating code to a scratch
buffer. This is essential when using <code>Memory.patchCode()</code> on iOS, which may
provide you with a temporary location that later gets mapped into memory at
the intended memory location.</p>
  </li>
  <li>
    <p><code>reset(codeAddress[, { pc: ptr('0x1234') }])</code>: recycle instance</p>
  </li>
  <li>
    <p><code>dispose()</code>: eagerly clean up memory</p>
  </li>
  <li>
    <p><code>flush()</code>: resolve label references and write pending data to memory. You
should always call this once you’ve finished generating code. It is usually
also desirable to do this between pieces of unrelated code, e.g. when
generating multiple functions in one go.</p>
  </li>
  <li>
    <p><code>base</code>: memory location of the first byte of output, as a NativePointer</p>
  </li>
  <li>
    <p><code>code</code>: memory location of the next byte of output, as a NativePointer</p>
  </li>
  <li>
    <p><code>pc</code>: program counter at the next byte of output, as a NativePointer</p>
  </li>
  <li>
    <p><code>offset</code>: current offset as a JavaScript Number</p>
  </li>
  <li>
    <p><code>putLabel(id)</code>: put a label at the current position, where <code>id</code> is a string
that may be referenced in past and future <code>put*Label()</code> calls</p>
  </li>
  <li>
    <p><code>putCallAddressWithArguments(func, args)</code>: put code needed for calling a C
function with the specified <code>args</code>, specified as a JavaScript array where
each element is either a string specifying the register, or a Number or
NativePointer specifying the immediate value.</p>
  </li>
  <li>
    <p><code>putCallAddressWithAlignedArguments(func, args)</code>: like above, but also
ensures that the argument list is aligned on a 16 byte boundary</p>
  </li>
  <li>
    <p><code>putCallRegWithArguments(reg, args)</code>: put code needed for calling a C
function with the specified <code>args</code>, specified as a JavaScript array where
each element is either a string specifying the register, or a Number or
NativePointer specifying the immediate value.</p>
  </li>
  <li>
    <p><code>putCallRegWithAlignedArguments(reg, args)</code>: like above, but also
ensures that the argument list is aligned on a 16 byte boundary</p>
  </li>
  <li>
    <p><code>putCallRegOffsetPtrWithArguments(reg, offset, args)</code>: put code needed for calling a C
function with the specified <code>args</code>, specified as a JavaScript array where
each element is either a string specifying the register, or a Number or
NativePointer specifying the immediate value.</p>
  </li>
  <li>
    <p><code>putCallAddress(address)</code>: put a CALL instruction</p>
  </li>
  <li>
    <p><code>putCallReg(reg)</code>: put a CALL instruction</p>
  </li>
  <li>
    <p><code>putCallRegOffsetPtr(reg, offset)</code>: put a CALL instruction</p>
  </li>
  <li>
    <p><code>putCallIndirect(addr)</code>: put a CALL instruction</p>
  </li>
  <li>
    <p><code>putCallIndirectLabel(labelId)</code>: put a CALL instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putCallNearLabel(labelId)</code>: put a CALL instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putLeave()</code>: put a LEAVE instruction</p>
  </li>
  <li>
    <p><code>putRet()</code>: put a RET instruction</p>
  </li>
  <li>
    <p><code>putRetImm(immValue)</code>: put a RET instruction</p>
  </li>
  <li>
    <p><code>putJmpAddress(address)</code>: put a JMP instruction</p>
  </li>
  <li>
    <p><code>putJmpShortLabel(labelId)</code>: put a JMP instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putJmpNearLabel(labelId)</code>: put a JMP instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putJmpReg(reg)</code>: put a JMP instruction</p>
  </li>
  <li>
    <p><code>putJmpRegPtr(reg)</code>: put a JMP instruction</p>
  </li>
  <li>
    <p><code>putJmpRegOffsetPtr(reg, offset)</code>: put a JMP instruction</p>
  </li>
  <li>
    <p><code>putJmpNearPtr(address)</code>: put a JMP instruction</p>
  </li>
  <li>
    <p><code>putJccShort(instructionId, target, hint)</code>: put a JCC instruction</p>
  </li>
  <li>
    <p><code>putJccNear(instructionId, target, hint)</code>: put a JCC instruction</p>
  </li>
  <li>
    <p><code>putJccShortLabel(instructionId, labelId, hint)</code>: put a JCC instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putJccNearLabel(instructionId, labelId, hint)</code>: put a JCC instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putAddRegImm(reg, immValue)</code>: put an ADD instruction</p>
  </li>
  <li>
    <p><code>putAddRegReg(dstReg, srcReg)</code>: put an ADD instruction</p>
  </li>
  <li>
    <p><code>putAddRegNearPtr(dstReg, srcAddress)</code>: put an ADD instruction</p>
  </li>
  <li>
    <p><code>putSubRegImm(reg, immValue)</code>: put a SUB instruction</p>
  </li>
  <li>
    <p><code>putSubRegReg(dstReg, srcReg)</code>: put a SUB instruction</p>
  </li>
  <li>
    <p><code>putSubRegNearPtr(dstReg, srcAddress)</code>: put a SUB instruction</p>
  </li>
  <li>
    <p><code>putIncReg(reg)</code>: put an INC instruction</p>
  </li>
  <li>
    <p><code>putDecReg(reg)</code>: put a DEC instruction</p>
  </li>
  <li>
    <p><code>putIncRegPtr(target, reg)</code>: put an INC instruction</p>
  </li>
  <li>
    <p><code>putDecRegPtr(target, reg)</code>: put a DEC instruction</p>
  </li>
  <li>
    <p><code>putLockXaddRegPtrReg(dstReg, srcReg)</code>: put a LOCK XADD instruction</p>
  </li>
  <li>
    <p><code>putLockCmpxchgRegPtrReg(dstReg, srcReg)</code>: put a LOCK CMPXCHG instruction</p>
  </li>
  <li>
    <p><code>putLockIncImm32Ptr(target)</code>: put a LOCK INC IMM32 instruction</p>
  </li>
  <li>
    <p><code>putLockDecImm32Ptr(target)</code>: put a LOCK DEC IMM32 instruction</p>
  </li>
  <li>
    <p><code>putAndRegReg(dstReg, srcReg)</code>: put an AND instruction</p>
  </li>
  <li>
    <p><code>putAndRegU32(reg, immValue)</code>: put an AND instruction</p>
  </li>
  <li>
    <p><code>putShlRegU8(reg, immValue)</code>: put a SHL instruction</p>
  </li>
  <li>
    <p><code>putShrRegU8(reg, immValue)</code>: put a SHR instruction</p>
  </li>
  <li>
    <p><code>putXorRegReg(dstReg, srcReg)</code>: put an XOR instruction</p>
  </li>
  <li>
    <p><code>putMovRegReg(dstReg, srcReg)</code>: put a MOV instruction</p>
  </li>
  <li>
    <p><code>putMovRegU32(dstReg, immValue)</code>: put a MOV instruction</p>
  </li>
  <li>
    <p><code>putMovRegU64(dstReg, immValue)</code>: put a MOV instruction</p>
  </li>
  <li>
    <p><code>putMovRegAddress(dstReg, address)</code>: put a MOV instruction</p>
  </li>
  <li>
    <p><code>putMovRegPtrU32(dstReg, immValue)</code>: put a MOV instruction</p>
  </li>
  <li>
    <p><code>putMovRegOffsetPtrU32(dstReg, dstOffset, immValue)</code>: put a MOV instruction</p>
  </li>
  <li>
    <p><code>putMovRegPtrReg(dstReg, srcReg)</code>: put a MOV instruction</p>
  </li>
  <li>
    <p><code>putMovRegOffsetPtrReg(dstReg, dstOffset, srcReg)</code>: put a MOV instruction</p>
  </li>
  <li>
    <p><code>putMovRegRegPtr(dstReg, srcReg)</code>: put a MOV instruction</p>
  </li>
  <li>
    <p><code>putMovRegRegOffsetPtr(dstReg, srcReg, srcOffset)</code>: put a MOV instruction</p>
  </li>
  <li>
    <p><code>putMovRegBaseIndexScaleOffsetPtr(dstReg, baseReg, indexReg, scale, offset)</code>: put a MOV instruction</p>
  </li>
  <li>
    <p><code>putMovRegNearPtr(dstReg, srcAddress)</code>: put a MOV instruction</p>
  </li>
  <li>
    <p><code>putMovNearPtrReg(dstAddress, srcReg)</code>: put a MOV instruction</p>
  </li>
  <li>
    <p><code>putMovFsU32PtrReg(fsOffset, srcReg)</code>: put a MOV FS instruction</p>
  </li>
  <li>
    <p><code>putMovRegFsU32Ptr(dstReg, fsOffset)</code>: put a MOV FS instruction</p>
  </li>
  <li>
    <p><code>putMovGsU32PtrReg(fsOffset, srcReg)</code>: put a MOV GS instruction</p>
  </li>
  <li>
    <p><code>putMovRegGsU32Ptr(dstReg, fsOffset)</code>: put a MOV GS instruction</p>
  </li>
  <li>
    <p><code>putMovqXmm0EspOffsetPtr(offset)</code>: put a MOVQ XMM0 ESP instruction</p>
  </li>
  <li>
    <p><code>putMovqEaxOffsetPtrXmm0(offset)</code>: put a MOVQ EAX XMM0 instruction</p>
  </li>
  <li>
    <p><code>putMovdquXmm0EspOffsetPtr(offset)</code>: put a MOVDQU XMM0 ESP instruction</p>
  </li>
  <li>
    <p><code>putMovdquEaxOffsetPtrXmm0(offset)</code>: put a MOVDQU EAX XMM0 instruction</p>
  </li>
  <li>
    <p><code>putLeaRegRegOffset(dstReg, srcReg, srcOffset)</code>: put a LEA instruction</p>
  </li>
  <li>
    <p><code>putXchgRegRegPtr(leftReg, rightReg)</code>: put an XCHG instruction</p>
  </li>
  <li>
    <p><code>putPushU32(immValue)</code>: put a PUSH instruction</p>
  </li>
  <li>
    <p><code>putPushNearPtr(address)</code>: put a PUSH instruction</p>
  </li>
  <li>
    <p><code>putPushReg(reg)</code>: put a PUSH instruction</p>
  </li>
  <li>
    <p><code>putPopReg(reg)</code>: put a POP instruction</p>
  </li>
  <li>
    <p><code>putPushImmPtr(immPtr)</code>: put a PUSH instruction</p>
  </li>
  <li>
    <p><code>putPushax()</code>: put a PUSHAX instruction</p>
  </li>
  <li>
    <p><code>putPopax()</code>: put a POPAX instruction</p>
  </li>
  <li>
    <p><code>putPushfx()</code>: put a PUSHFX instruction</p>
  </li>
  <li>
    <p><code>putPopfx()</code>: put a POPFX instruction</p>
  </li>
  <li>
    <p><code>putTestRegReg(regA, regB)</code>: put a TEST instruction</p>
  </li>
  <li>
    <p><code>putTestRegU32(reg, immValue)</code>: put a TEST instruction</p>
  </li>
  <li>
    <p><code>putCmpRegI32(reg, immValue)</code>: put a CMP instruction</p>
  </li>
  <li>
    <p><code>putCmpRegOffsetPtrReg(regA, offset, regB)</code>: put a CMP instruction</p>
  </li>
  <li>
    <p><code>putCmpImmPtrImmU32(immPtr, immValue)</code>: put a CMP instruction</p>
  </li>
  <li>
    <p><code>putCmpRegReg(regA, regB)</code>: put a CMP instruction</p>
  </li>
  <li>
    <p><code>putClc()</code>: put a CLC instruction</p>
  </li>
  <li>
    <p><code>putStc()</code>: put a STC instruction</p>
  </li>
  <li>
    <p><code>putCld()</code>: put a CLD instruction</p>
  </li>
  <li>
    <p><code>putStd()</code>: put a STD instruction</p>
  </li>
  <li>
    <p><code>putCpuid()</code>: put a CPUID instruction</p>
  </li>
  <li>
    <p><code>putLfence()</code>: put an LFENCE instruction</p>
  </li>
  <li>
    <p><code>putRdtsc()</code>: put an RDTSC instruction</p>
  </li>
  <li>
    <p><code>putPause()</code>: put a PAUSE instruction</p>
  </li>
  <li>
    <p><code>putNop()</code>: put a NOP instruction</p>
  </li>
  <li>
    <p><code>putBreakpoint()</code>: put an OS/architecture-specific breakpoint instruction</p>
  </li>
  <li>
    <p><code>putPadding(n)</code>: put <code>n</code> guard instruction</p>
  </li>
  <li>
    <p><code>putNopPadding(n)</code>: put <code>n</code> NOP instructions</p>
  </li>
  <li>
    <p><code>putU8(value)</code>: put a uint8</p>
  </li>
  <li>
    <p><code>putS8(value)</code>: put an int8</p>
  </li>
  <li>
    <p><code>putBytes(data)</code>: put raw data from the provided ArrayBuffer</p>
  </li>
</ul>

<h2 id="x86relocator">X86Relocator</h2>

<ul>
  <li>
    <p><code>new X86Relocator(inputCode, output)</code>: create a new code relocator for
copying x86 instructions from one memory location to another, taking
care to adjust position-dependent instructions accordingly.
The source address is specified by <code>inputCode</code>, a NativePointer.
The destination is given by <code>output</code>, an <a href="https://frida.re/docs/javascript-api/#x86writer">X86Writer</a> pointed
at the desired target memory address.</p>
  </li>
  <li>
    <p><code>reset(inputCode, output)</code>: recycle instance</p>
  </li>
  <li>
    <p><code>dispose()</code>: eagerly clean up memory</p>
  </li>
  <li>
    <p><code>input</code>: latest <a href="https://frida.re/docs/javascript-api/#instruction">Instruction</a> read so far. Starts out <code>null</code>
and changes on every call to <code>readOne()</code>.</p>
  </li>
  <li>
    <p><code>eob</code>: boolean indicating whether end-of-block has been reached, i.e. we’ve
reached a branch of any kind, like CALL, JMP, BL, RET.</p>
  </li>
  <li>
    <p><code>eoi</code>: boolean indicating whether end-of-input has been reached, e.g. we’ve
reached JMP/B/RET, an instruction after which there may or may not be valid
code.</p>
  </li>
  <li>
    <p><code>readOne()</code>: read the next instruction into the relocator’s internal buffer
and return the number of bytes read so far, including previous calls.
You may keep calling this method to keep buffering, or immediately call
either <code>writeOne()</code> or <code>skipOne()</code>. Or, you can buffer up until the desired
point and then call <code>writeAll()</code>.
Returns zero when end-of-input is reached, which means the <code>eoi</code> property is
now <code>true</code>.</p>
  </li>
  <li>
    <p><code>peekNextWriteInsn()</code>: peek at the next <a href="https://frida.re/docs/javascript-api/#instruction">Instruction</a> to be
written or skipped</p>
  </li>
  <li>
    <p><code>peekNextWriteSource()</code>: peek at the address of the next instruction to be
written or skipped</p>
  </li>
  <li>
    <p><code>skipOne()</code>: skip the instruction that would have been written next</p>
  </li>
  <li>
    <p><code>skipOneNoLabel()</code>: skip the instruction that would have been written next,
but without a label for internal use. This breaks relocation of branches to
locations inside the relocated range, and is an optimization for use-cases
where all branches are rewritten (e.g. Frida’s Stalker).</p>
  </li>
  <li>
    <p><code>writeOne()</code>: write the next buffered instruction</p>
  </li>
  <li>
    <p><code>writeOneNoLabel()</code>: write the next buffered instruction, but without a
label for internal use. This breaks relocation of branches to locations
inside the relocated range, and is an optimization for use-cases where all
branches are rewritten (e.g. Frida’s Stalker).</p>
  </li>
  <li>
    <p><code>writeAll()</code>: write all buffered instructions</p>
  </li>
</ul>

<h2 id="x86-enum-types">x86 enum types</h2>

<ul>
  <li>Register: <code>xax</code> <code>xcx</code> <code>xdx</code> <code>xbx</code> <code>xsp</code> <code>xbp</code> <code>xsi</code> <code>xdi</code> <code>eax</code> <code>ecx</code> <code>edx</code>
<code>ebx</code> <code>esp</code> <code>ebp</code> <code>esi</code> <code>edi</code> <code>rax</code> <code>rcx</code> <code>rdx</code> <code>rbx</code> <code>rsp</code> <code>rbp</code> <code>rsi</code>
<code>rdi</code> <code>r8</code> <code>r9</code> <code>r10</code> <code>r11</code> <code>r12</code> <code>r13</code> <code>r14</code> <code>r15</code> <code>r8d</code> <code>r9d</code> <code>r10d</code>
<code>r11d</code> <code>r12d</code> <code>r13d</code> <code>r14d</code> <code>r15d</code> <code>xip</code> <code>eip</code> <code>rip</code></li>
  <li>InstructionId: <code>jo</code> <code>jno</code> <code>jb</code> <code>jae</code> <code>je</code> <code>jne</code> <code>jbe</code> <code>ja</code> <code>js</code> <code>jns</code> <code>jp</code>
<code>jnp</code> <code>jl</code> <code>jge</code> <code>jle</code> <code>jg</code> <code>jcxz</code> <code>jecxz</code> <code>jrcxz</code></li>
  <li>BranchHint: <code>no-hint</code> <code>likely</code> <code>unlikely</code></li>
  <li>PointerTarget: <code>byte</code> <code>dword</code> <code>qword</code></li>
</ul>

<h2 id="armwriter">ArmWriter</h2>

<ul>
  <li>
    <p><code>new ArmWriter(codeAddress[, { pc: ptr('0x1234') }])</code>: create a new code
writer for generating ARM machine code written directly to memory at
<code>codeAddress</code>, specified as a NativePointer.
The second argument is an optional options object where the initial program
counter may be specified, which is useful when generating code to a scratch
buffer. This is essential when using <code>Memory.patchCode()</code> on iOS, which may
provide you with a temporary location that later gets mapped into memory at
the intended memory location.</p>
  </li>
  <li>
    <p><code>reset(codeAddress[, { pc: ptr('0x1234') }])</code>: recycle instance</p>
  </li>
  <li>
    <p><code>dispose()</code>: eagerly clean up memory</p>
  </li>
  <li>
    <p><code>flush()</code>: resolve label references and write pending data to memory. You
should always call this once you’ve finished generating code. It is usually
also desirable to do this between pieces of unrelated code, e.g. when
generating multiple functions in one go.</p>
  </li>
  <li>
    <p><code>base</code>: memory location of the first byte of output, as a NativePointer</p>
  </li>
  <li>
    <p><code>code</code>: memory location of the next byte of output, as a NativePointer</p>
  </li>
  <li>
    <p><code>pc</code>: program counter at the next byte of output, as a NativePointer</p>
  </li>
  <li>
    <p><code>offset</code>: current offset as a JavaScript Number</p>
  </li>
  <li>
    <p><code>skip(nBytes)</code>: skip <code>nBytes</code></p>
  </li>
  <li>
    <p><code>putLabel(id)</code>: put a label at the current position, where <code>id</code> is a string
that may be referenced in past and future <code>put*Label()</code> calls</p>
  </li>
  <li>
    <p><code>putBImm(target)</code>: put a B instruction</p>
  </li>
  <li>
    <p><code>putBxReg(reg)</code>: put a BX instruction</p>
  </li>
  <li>
    <p><code>putBLabel(labelId)</code>: put a B instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putLdrRegAddress(reg, address)</code>: put an LDR instruction</p>
  </li>
  <li>
    <p><code>putLdrRegU32(reg, val)</code>: put an LDR instruction</p>
  </li>
  <li>
    <p><code>putAddRegRegImm(dstReg, srcReg, immVal)</code>: put an ADD instruction</p>
  </li>
  <li>
    <p><code>putLdrRegRegImm(dstReg, srcReg, immVal)</code>: put an LDR instruction</p>
  </li>
  <li>
    <p><code>putNop()</code>: put a NOP instruction</p>
  </li>
  <li>
    <p><code>putBreakpoint()</code>: put an OS/architecture-specific breakpoint instruction</p>
  </li>
  <li>
    <p><code>putInstruction(insn)</code>: put a raw instruction as a JavaScript Number</p>
  </li>
  <li>
    <p><code>putBytes(data)</code>: put raw data from the provided ArrayBuffer</p>
  </li>
</ul>

<h2 id="armrelocator">ArmRelocator</h2>

<ul>
  <li>
    <p><code>new ArmRelocator(inputCode, output)</code>: create a new code relocator for
copying ARM instructions from one memory location to another, taking
care to adjust position-dependent instructions accordingly.
The source address is specified by <code>inputCode</code>, a NativePointer.
The destination is given by <code>output</code>, an <a href="https://frida.re/docs/javascript-api/#armwriter">ArmWriter</a> pointed
at the desired target memory address.</p>
  </li>
  <li>
    <p><code>reset(inputCode, output)</code>: recycle instance</p>
  </li>
  <li>
    <p><code>dispose()</code>: eagerly clean up memory</p>
  </li>
  <li>
    <p><code>input</code>: latest <a href="https://frida.re/docs/javascript-api/#instruction">Instruction</a> read so far. Starts out <code>null</code>
and changes on every call to <code>readOne()</code>.</p>
  </li>
  <li>
    <p><code>eob</code>: boolean indicating whether end-of-block has been reached, i.e. we’ve
reached a branch of any kind, like CALL, JMP, BL, RET.</p>
  </li>
  <li>
    <p><code>eoi</code>: boolean indicating whether end-of-input has been reached, e.g. we’ve
reached JMP/B/RET, an instruction after which there may or may not be valid
code.</p>
  </li>
  <li>
    <p><code>readOne()</code>: read the next instruction into the relocator’s internal buffer
and return the number of bytes read so far, including previous calls.
You may keep calling this method to keep buffering, or immediately call
either <code>writeOne()</code> or <code>skipOne()</code>. Or, you can buffer up until the desired
point and then call <code>writeAll()</code>.
Returns zero when end-of-input is reached, which means the <code>eoi</code> property is
now <code>true</code>.</p>
  </li>
  <li>
    <p><code>peekNextWriteInsn()</code>: peek at the next <a href="https://frida.re/docs/javascript-api/#instruction">Instruction</a> to be
written or skipped</p>
  </li>
  <li>
    <p><code>peekNextWriteSource()</code>: peek at the address of the next instruction to be
written or skipped</p>
  </li>
  <li>
    <p><code>skipOne()</code>: skip the instruction that would have been written next</p>
  </li>
  <li>
    <p><code>writeOne()</code>: write the next buffered instruction</p>
  </li>
  <li>
    <p><code>writeAll()</code>: write all buffered instructions</p>
  </li>
</ul>

<h2 id="thumbwriter">ThumbWriter</h2>

<ul>
  <li>
    <p><code>new ThumbWriter(codeAddress[, { pc: ptr('0x1234') }])</code>: create a new code
writer for generating ARM machine code written directly to memory at
<code>codeAddress</code>, specified as a NativePointer.
The second argument is an optional options object where the initial program
counter may be specified, which is useful when generating code to a scratch
buffer. This is essential when using <code>Memory.patchCode()</code> on iOS, which may
provide you with a temporary location that later gets mapped into memory at
the intended memory location.</p>
  </li>
  <li>
    <p><code>reset(codeAddress[, { pc: ptr('0x1234') }])</code>: recycle instance</p>
  </li>
  <li>
    <p><code>dispose()</code>: eagerly clean up memory</p>
  </li>
  <li>
    <p><code>flush()</code>: resolve label references and write pending data to memory. You
should always call this once you’ve finished generating code. It is usually
also desirable to do this between pieces of unrelated code, e.g. when
generating multiple functions in one go.</p>
  </li>
  <li>
    <p><code>base</code>: memory location of the first byte of output, as a NativePointer</p>
  </li>
  <li>
    <p><code>code</code>: memory location of the next byte of output, as a NativePointer</p>
  </li>
  <li>
    <p><code>pc</code>: program counter at the next byte of output, as a NativePointer</p>
  </li>
  <li>
    <p><code>offset</code>: current offset as a JavaScript Number</p>
  </li>
  <li>
    <p><code>skip(nBytes)</code>: skip <code>nBytes</code></p>
  </li>
  <li>
    <p><code>putLabel(id)</code>: put a label at the current position, where <code>id</code> is a string
that may be referenced in past and future <code>put*Label()</code> calls</p>
  </li>
  <li>
    <p><code>putCallAddressWithArguments(func, args)</code>: put code needed for calling a C
function with the specified <code>args</code>, specified as a JavaScript array where
each element is either a string specifying the register, or a Number or
NativePointer specifying the immediate value.</p>
  </li>
  <li>
    <p><code>putCallRegWithArguments(reg, args)</code>: put code needed for calling a C
function with the specified <code>args</code>, specified as a JavaScript array where
each element is either a string specifying the register, or a Number or
NativePointer specifying the immediate value.</p>
  </li>
  <li>
    <p><code>putBImm(target)</code>: put a B instruction</p>
  </li>
  <li>
    <p><code>putBLabel(labelId)</code>: put a B instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putBLabelWide(labelId)</code>: put a B WIDE instruction</p>
  </li>
  <li>
    <p><code>putBxReg(reg)</code>: put a BX instruction</p>
  </li>
  <li>
    <p><code>putBlImm(target)</code>: put a BL instruction</p>
  </li>
  <li>
    <p><code>putBlLabel(labelId)</code>: put a BL instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putBlxImm(target)</code>: put a BLX instruction</p>
  </li>
  <li>
    <p><code>putBlxReg(reg)</code>: put a BLX instruction</p>
  </li>
  <li>
    <p><code>putCmpRegImm(reg, immValue)</code>: put a CMP instruction</p>
  </li>
  <li>
    <p><code>putBeqLabel(labelId)</code>: put a BEQ instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putBneLabel(labelId)</code>: put a BNE instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putBCondLabel(cc, labelId)</code>: put a B COND instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putBCondLabelWide(cc, labelId)</code>: put a B COND WIDE instruction</p>
  </li>
  <li>
    <p><code>putCbzRegLabel(reg, labelId)</code>: put a CBZ instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putCbnzRegLabel(reg, labelId)</code>: put a CBNZ instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putPushRegs(regs)</code>: put a PUSH instruction with the specified registers,
specified as a JavaScript array where each element is a string specifying
the register name.</p>
  </li>
  <li>
    <p><code>putPopRegs(regs)</code>: put a POP instruction with the specified registers,
specified as a JavaScript array where each element is a string specifying
the register name.</p>
  </li>
  <li>
    <p><code>putLdrRegAddress(reg, address)</code>: put an LDR instruction</p>
  </li>
  <li>
    <p><code>putLdrRegU32(reg, val)</code>: put an LDR instruction</p>
  </li>
  <li>
    <p><code>putLdrRegReg(dstReg, srcReg)</code>: put an LDR instruction</p>
  </li>
  <li>
    <p><code>putLdrRegRegOffset(dstReg, srcReg, srcOffset)</code>: put an LDR instruction</p>
  </li>
  <li>
    <p><code>putStrRegReg(srcReg, dstReg)</code>: put a STR instruction</p>
  </li>
  <li>
    <p><code>putStrRegRegOffset(srcReg, dstReg, dstOffset)</code>: put a STR instruction</p>
  </li>
  <li>
    <p><code>putMovRegReg(dstReg, srcReg)</code>: put a MOV instruction</p>
  </li>
  <li>
    <p><code>putMovRegU8(dstReg, immValue)</code>: put a MOV instruction</p>
  </li>
  <li>
    <p><code>putAddRegImm(dstReg, immValue)</code>: put an ADD instruction</p>
  </li>
  <li>
    <p><code>putAddRegReg(dstReg, srcReg)</code>: put an ADD instruction</p>
  </li>
  <li>
    <p><code>putAddRegRegReg(dstReg, leftReg, rightReg)</code>: put an ADD instruction</p>
  </li>
  <li>
    <p><code>putAddRegRegImm(dstReg, leftReg, rightValue)</code>: put an ADD instruction</p>
  </li>
  <li>
    <p><code>putSubRegImm(dstReg, immValue)</code>: put a SUB instruction</p>
  </li>
  <li>
    <p><code>putSubRegReg(dstReg, srcReg)</code>: put a SUB instruction</p>
  </li>
  <li>
    <p><code>putSubRegRegReg(dstReg, leftReg, rightReg)</code>: put a SUB instruction</p>
  </li>
  <li>
    <p><code>putSubRegRegImm(dstReg, leftReg, rightValue)</code>: put a SUB instruction</p>
  </li>
  <li>
    <p><code>putMrsRegReg(dstReg, srcReg)</code>: put a MRS instruction</p>
  </li>
  <li>
    <p><code>putMsrRegReg(dstReg, srcReg)</code>: put a MSR instruction</p>
  </li>
  <li>
    <p><code>putNop()</code>: put a NOP instruction</p>
  </li>
  <li>
    <p><code>putBkptImm(imm)</code>: put a BKPT instruction</p>
  </li>
  <li>
    <p><code>putBreakpoint()</code>: put an OS/architecture-specific breakpoint instruction</p>
  </li>
  <li>
    <p><code>putInstruction(insn)</code>: put a raw instruction as a JavaScript Number</p>
  </li>
  <li>
    <p><code>putInstructionWide(upper, lower)</code>: put a raw Thumb-2 instruction from
two JavaScript Number values</p>
  </li>
  <li>
    <p><code>putBytes(data)</code>: put raw data from the provided ArrayBuffer</p>
  </li>
</ul>

<h2 id="thumbrelocator">ThumbRelocator</h2>

<ul>
  <li>
    <p><code>new ThumbRelocator(inputCode, output)</code>: create a new code relocator for
copying ARM instructions from one memory location to another, taking
care to adjust position-dependent instructions accordingly.
The source address is specified by <code>inputCode</code>, a NativePointer.
The destination is given by <code>output</code>, a <a href="https://frida.re/docs/javascript-api/#thumbwriter">ThumbWriter</a> pointed
at the desired target memory address.</p>
  </li>
  <li>
    <p><code>reset(inputCode, output)</code>: recycle instance</p>
  </li>
  <li>
    <p><code>dispose()</code>: eagerly clean up memory</p>
  </li>
  <li>
    <p><code>input</code>: latest <a href="https://frida.re/docs/javascript-api/#instruction">Instruction</a> read so far. Starts out <code>null</code>
and changes on every call to <code>readOne()</code>.</p>
  </li>
  <li>
    <p><code>eob</code>: boolean indicating whether end-of-block has been reached, i.e. we’ve
reached a branch of any kind, like CALL, JMP, BL, RET.</p>
  </li>
  <li>
    <p><code>eoi</code>: boolean indicating whether end-of-input has been reached, e.g. we’ve
reached JMP/B/RET, an instruction after which there may or may not be valid
code.</p>
  </li>
  <li>
    <p><code>readOne()</code>: read the next instruction into the relocator’s internal buffer
and return the number of bytes read so far, including previous calls.
You may keep calling this method to keep buffering, or immediately call
either <code>writeOne()</code> or <code>skipOne()</code>. Or, you can buffer up until the desired
point and then call <code>writeAll()</code>.
Returns zero when end-of-input is reached, which means the <code>eoi</code> property is
now <code>true</code>.</p>
  </li>
  <li>
    <p><code>peekNextWriteInsn()</code>: peek at the next <a href="https://frida.re/docs/javascript-api/#instruction">Instruction</a> to be
written or skipped</p>
  </li>
  <li>
    <p><code>peekNextWriteSource()</code>: peek at the address of the next instruction to be
written or skipped</p>
  </li>
  <li>
    <p><code>skipOne()</code>: skip the instruction that would have been written next</p>
  </li>
  <li>
    <p><code>writeOne()</code>: write the next buffered instruction</p>
  </li>
  <li>
    <p><code>writeAll()</code>: write all buffered instructions</p>
  </li>
</ul>

<h2 id="arm-enum-types">ARM enum types</h2>

<ul>
  <li>Register: <code>r0</code> <code>r1</code> <code>r2</code> <code>r3</code> <code>r4</code> <code>r5</code> <code>r6</code> <code>r7</code> <code>r8</code> <code>r9</code> <code>r10</code> <code>r11</code>
<code>r12</code> <code>r13</code> <code>r14</code> <code>r15</code> <code>sp</code> <code>lr</code> <code>sb</code> <code>sl</code> <code>fp</code> <code>ip</code> <code>pc</code></li>
  <li>SystemRegister: <code>apsr-nzcvq</code></li>
  <li>ConditionCode: <code>eq</code> <code>ne</code> <code>hs</code> <code>lo</code> <code>mi</code> <code>pl</code> <code>vs</code> <code>vc</code> <code>hi</code> <code>ls</code> <code>ge</code> <code>lt</code>
<code>gt</code> <code>le</code> <code>al</code></li>
</ul>

<h2 id="arm64writer">Arm64Writer</h2>

<ul>
  <li>
    <p><code>new Arm64Writer(codeAddress[, { pc: ptr('0x1234') }])</code>: create a new code
writer for generating AArch64 machine code written directly to memory at
<code>codeAddress</code>, specified as a NativePointer.
The second argument is an optional options object where the initial program
counter may be specified, which is useful when generating code to a scratch
buffer. This is essential when using <code>Memory.patchCode()</code> on iOS, which may
provide you with a temporary location that later gets mapped into memory at
the intended memory location.</p>
  </li>
  <li>
    <p><code>reset(codeAddress[, { pc: ptr('0x1234') }])</code>: recycle instance</p>
  </li>
  <li>
    <p><code>dispose()</code>: eagerly clean up memory</p>
  </li>
  <li>
    <p><code>flush()</code>: resolve label references and write pending data to memory. You
should always call this once you’ve finished generating code. It is usually
also desirable to do this between pieces of unrelated code, e.g. when
generating multiple functions in one go.</p>
  </li>
  <li>
    <p><code>base</code>: memory location of the first byte of output, as a NativePointer</p>
  </li>
  <li>
    <p><code>code</code>: memory location of the next byte of output, as a NativePointer</p>
  </li>
  <li>
    <p><code>pc</code>: program counter at the next byte of output, as a NativePointer</p>
  </li>
  <li>
    <p><code>offset</code>: current offset as a JavaScript Number</p>
  </li>
  <li>
    <p><code>skip(nBytes)</code>: skip <code>nBytes</code></p>
  </li>
  <li>
    <p><code>putLabel(id)</code>: put a label at the current position, where <code>id</code> is a string
that may be referenced in past and future <code>put*Label()</code> calls</p>
  </li>
  <li>
    <p><code>putCallAddressWithArguments(func, args)</code>: put code needed for calling a C
function with the specified <code>args</code>, specified as a JavaScript array where
each element is either a string specifying the register, or a Number or
NativePointer specifying the immediate value.</p>
  </li>
  <li>
    <p><code>putCallRegWithArguments(reg, args)</code>: put code needed for calling a C
function with the specified <code>args</code>, specified as a JavaScript array where
each element is either a string specifying the register, or a Number or
NativePointer specifying the immediate value.</p>
  </li>
  <li>
    <p><code>putBranchAddress(address)</code>: put a BRANCH instruction</p>
  </li>
  <li>
    <p><code>putBImm(address)</code>: put a B instruction</p>
  </li>
  <li>
    <p><code>putBLabel(labelId)</code>: put a B instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putBCondLabel(cc, labelId)</code>: put a B COND instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putBlImm(address)</code>: put a BL instruction</p>
  </li>
  <li>
    <p><code>putBlLabel(labelId)</code>: put a BL instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putBrReg(reg)</code>: put a BR instruction</p>
  </li>
  <li>
    <p><code>putBlrReg(reg)</code>: put a BLR instruction</p>
  </li>
  <li>
    <p><code>putRet()</code>: put a RET instruction</p>
  </li>
  <li>
    <p><code>putCbzRegLabel(reg, labelId)</code>: put a CBZ instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putCbnzRegLabel(reg, labelId)</code>: put a CBNZ instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putTbzRegImmLabel(reg, bit, labelId)</code>: put a TBZ instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putTbnzRegImmLabel(reg, bit, labelId)</code>: put a TBNZ instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putPushRegReg(regA, regB)</code>: put a PUSH instruction</p>
  </li>
  <li>
    <p><code>putPopRegReg(regA, regB)</code>: put a POP instruction</p>
  </li>
  <li>
    <p><code>putPushAllXRegisters()</code>: put code needed for pushing all X registers on the stack</p>
  </li>
  <li>
    <p><code>putPopAllXRegisters()</code>: put code needed for popping all X registers off the stack</p>
  </li>
  <li>
    <p><code>putPushAllQRegisters()</code>: put code needed for pushing all Q registers on the stack</p>
  </li>
  <li>
    <p><code>putPopAllQRegisters()</code>: put code needed for popping all Q registers off the stack</p>
  </li>
  <li>
    <p><code>putLdrRegAddress(reg, address)</code>: put an LDR instruction</p>
  </li>
  <li>
    <p><code>putLdrRegU64(reg, val)</code>: put an LDR instruction</p>
  </li>
  <li>
    <p><code>putLdrRegRef(reg)</code>: put an LDR instruction with a dangling data reference,
returning an opaque ref value that should be passed to <code>putLdrRegValue()</code>
at the desired location</p>
  </li>
  <li>
    <p><code>putLdrRegValue(ref, value)</code>: put the value and update the LDR instruction
from a previous <code>putLdrRegRef()</code></p>
  </li>
  <li>
    <p><code>putLdrRegRegOffset(dstReg, srcReg, srcOffset)</code>: put an LDR instruction</p>
  </li>
  <li>
    <p><code>putLdrswRegRegOffset(dstReg, srcReg, srcOffset)</code>: put an LDRSW instruction</p>
  </li>
  <li>
    <p><code>putAdrpRegAddress(reg, address)</code>: put an ADRP instruction</p>
  </li>
  <li>
    <p><code>putStrRegRegOffset(srcReg, dstReg, dstOffset)</code>: put a STR instruction</p>
  </li>
  <li>
    <p><code>putLdpRegRegRegOffset(regA, regB, regSrc, srcOffset, mode)</code>: put an LDP instruction</p>
  </li>
  <li>
    <p><code>putStpRegRegRegOffset(regA, regB, regDst, dstOffset, mode)</code>: put a STP instruction</p>
  </li>
  <li>
    <p><code>putMovRegReg(dstReg, srcReg)</code>: put a MOV instruction</p>
  </li>
  <li>
    <p><code>putUxtwRegReg(dstReg, srcReg)</code>: put an UXTW instruction</p>
  </li>
  <li>
    <p><code>putAddRegRegImm(dstReg, leftReg, rightValue)</code>: put an ADD instruction</p>
  </li>
  <li>
    <p><code>putAddRegRegReg(dstReg, leftReg, rightReg)</code>: put an ADD instruction</p>
  </li>
  <li>
    <p><code>putSubRegRegImm(dstReg, leftReg, rightValue)</code>: put a SUB instruction</p>
  </li>
  <li>
    <p><code>putSubRegRegReg(dstReg, leftReg, rightReg)</code>: put a SUB instruction</p>
  </li>
  <li>
    <p><code>putAndRegRegImm(dstReg, leftReg, rightValue)</code>: put an AND instruction</p>
  </li>
  <li>
    <p><code>putTstRegImm(reg, immValue)</code>: put a TST instruction</p>
  </li>
  <li>
    <p><code>putCmpRegReg(regA, regB)</code>: put a CMP instruction</p>
  </li>
  <li>
    <p><code>putNop()</code>: put a NOP instruction</p>
  </li>
  <li>
    <p><code>putBrkImm(imm)</code>: put a BRK instruction</p>
  </li>
  <li>
    <p><code>putInstruction(insn)</code>: put a raw instruction as a JavaScript Number</p>
  </li>
  <li>
    <p><code>putBytes(data)</code>: put raw data from the provided ArrayBuffer</p>
  </li>
</ul>

<h2 id="arm64relocator">Arm64Relocator</h2>

<ul>
  <li>
    <p><code>new Arm64Relocator(inputCode, output)</code>: create a new code relocator for
copying AArch64 instructions from one memory location to another, taking
care to adjust position-dependent instructions accordingly.
The source address is specified by <code>inputCode</code>, a NativePointer.
The destination is given by <code>output</code>, an <a href="https://frida.re/docs/javascript-api/#arm64writer">Arm64Writer</a> pointed
at the desired target memory address.</p>
  </li>
  <li>
    <p><code>reset(inputCode, output)</code>: recycle instance</p>
  </li>
  <li>
    <p><code>dispose()</code>: eagerly clean up memory</p>
  </li>
  <li>
    <p><code>input</code>: latest <a href="https://frida.re/docs/javascript-api/#instruction">Instruction</a> read so far. Starts out <code>null</code>
and changes on every call to <code>readOne()</code>.</p>
  </li>
  <li>
    <p><code>eob</code>: boolean indicating whether end-of-block has been reached, i.e. we’ve
reached a branch of any kind, like CALL, JMP, BL, RET.</p>
  </li>
  <li>
    <p><code>eoi</code>: boolean indicating whether end-of-input has been reached, e.g. we’ve
reached JMP/B/RET, an instruction after which there may or may not be valid
code.</p>
  </li>
  <li>
    <p><code>readOne()</code>: read the next instruction into the relocator’s internal buffer
and return the number of bytes read so far, including previous calls.
You may keep calling this method to keep buffering, or immediately call
either <code>writeOne()</code> or <code>skipOne()</code>. Or, you can buffer up until the desired
point and then call <code>writeAll()</code>.
Returns zero when end-of-input is reached, which means the <code>eoi</code> property is
now <code>true</code>.</p>
  </li>
  <li>
    <p><code>peekNextWriteInsn()</code>: peek at the next <a href="https://frida.re/docs/javascript-api/#instruction">Instruction</a> to be
written or skipped</p>
  </li>
  <li>
    <p><code>peekNextWriteSource()</code>: peek at the address of the next instruction to be
written or skipped</p>
  </li>
  <li>
    <p><code>skipOne()</code>: skip the instruction that would have been written next</p>
  </li>
  <li>
    <p><code>writeOne()</code>: write the next buffered instruction</p>
  </li>
  <li>
    <p><code>writeAll()</code>: write all buffered instructions</p>
  </li>
</ul>

<h2 id="aarch64-enum-types">AArch64 enum types</h2>

<ul>
  <li>Register: <code>x0</code> <code>x1</code> <code>x2</code> <code>x3</code> <code>x4</code> <code>x5</code> <code>x6</code> <code>x7</code> <code>x8</code> <code>x9</code> <code>x10</code> <code>x11</code>
<code>x12</code> <code>x13</code> <code>x14</code> <code>x15</code> <code>x16</code> <code>x17</code> <code>x18</code> <code>x19</code> <code>x20</code> <code>x21</code> <code>x22</code> <code>x23</code>
<code>x24</code> <code>x25</code> <code>x26</code> <code>x27</code> <code>x28</code> <code>x29</code> <code>x30</code> <code>w0</code> <code>w1</code> <code>w2</code> <code>w3</code> <code>w4</code> <code>w5</code>
<code>w6</code> <code>w7</code> <code>w8</code> <code>w9</code> <code>w10</code> <code>w11</code> <code>w12</code> <code>w13</code> <code>w14</code> <code>w15</code> <code>w16</code> <code>w17</code> <code>w18</code>
<code>w19</code> <code>w20</code> <code>w21</code> <code>w22</code> <code>w23</code> <code>w24</code> <code>w25</code> <code>w26</code> <code>w27</code> <code>w28</code> <code>w29</code> <code>w30</code>
<code>sp</code> <code>lr</code> <code>fp</code> <code>wsp</code> <code>wzr</code> <code>xzr</code> <code>nzcv</code> <code>ip0</code> <code>ip1</code> <code>s0</code> <code>s1</code> <code>s2</code> <code>s3</code>
<code>s4</code> <code>s5</code> <code>s6</code> <code>s7</code> <code>s8</code> <code>s9</code> <code>s10</code> <code>s11</code> <code>s12</code> <code>s13</code> <code>s14</code> <code>s15</code> <code>s16</code>
<code>s17</code> <code>s18</code> <code>s19</code> <code>s20</code> <code>s21</code> <code>s22</code> <code>s23</code> <code>s24</code> <code>s25</code> <code>s26</code> <code>s27</code> <code>s28</code>
<code>s29</code> <code>s30</code> <code>s31</code> <code>d0</code> <code>d1</code> <code>d2</code> <code>d3</code> <code>d4</code> <code>d5</code> <code>d6</code> <code>d7</code> <code>d8</code> <code>d9</code> <code>d10</code>
<code>d11</code> <code>d12</code> <code>d13</code> <code>d14</code> <code>d15</code> <code>d16</code> <code>d17</code> <code>d18</code> <code>d19</code> <code>d20</code> <code>d21</code> <code>d22</code>
<code>d23</code> <code>d24</code> <code>d25</code> <code>d26</code> <code>d27</code> <code>d28</code> <code>d29</code> <code>d30</code> <code>d31</code> <code>q0</code> <code>q1</code> <code>q2</code> <code>q3</code>
<code>q4</code> <code>q5</code> <code>q6</code> <code>q7</code> <code>q8</code> <code>q9</code> <code>q10</code> <code>q11</code> <code>q12</code> <code>q13</code> <code>q14</code> <code>q15</code> <code>q16</code>
<code>q17</code> <code>q18</code> <code>q19</code> <code>q20</code> <code>q21</code> <code>q22</code> <code>q23</code> <code>q24</code> <code>q25</code> <code>q26</code> <code>q27</code> <code>q28</code>
<code>q29</code> <code>q30</code> <code>q31</code></li>
  <li>ConditionCode: <code>eq</code> <code>ne</code> <code>hs</code> <code>lo</code> <code>mi</code> <code>pl</code> <code>vs</code> <code>vc</code> <code>hi</code> <code>ls</code> <code>ge</code> <code>lt</code>
<code>gt</code> <code>le</code> <code>al</code> <code>nv</code></li>
  <li>IndexMode: <code>post-adjust</code> <code>signed-offset</code> <code>pre-adjust</code></li>
</ul>

<h2 id="mipswriter">MipsWriter</h2>

<ul>
  <li>
    <p><code>new MipsWriter(codeAddress[, { pc: ptr('0x1234') }])</code>: create a new code
writer for generating MIPS machine code written directly to memory at
<code>codeAddress</code>, specified as a NativePointer.
The second argument is an optional options object where the initial program
counter may be specified, which is useful when generating code to a scratch
buffer. This is essential when using <code>Memory.patchCode()</code> on iOS, which may
provide you with a temporary location that later gets mapped into memory at
the intended memory location.</p>
  </li>
  <li>
    <p><code>reset(codeAddress[, { pc: ptr('0x1234') }])</code>: recycle instance</p>
  </li>
  <li>
    <p><code>dispose()</code>: eagerly clean up memory</p>
  </li>
  <li>
    <p><code>flush()</code>: resolve label references and write pending data to memory. You
should always call this once you’ve finished generating code. It is usually
also desirable to do this between pieces of unrelated code, e.g. when
generating multiple functions in one go.</p>
  </li>
  <li>
    <p><code>base</code>: memory location of the first byte of output, as a NativePointer</p>
  </li>
  <li>
    <p><code>code</code>: memory location of the next byte of output, as a NativePointer</p>
  </li>
  <li>
    <p><code>pc</code>: program counter at the next byte of output, as a NativePointer</p>
  </li>
  <li>
    <p><code>offset</code>: current offset as a JavaScript Number</p>
  </li>
  <li>
    <p><code>skip(nBytes)</code>: skip <code>nBytes</code></p>
  </li>
  <li>
    <p><code>putLabel(id)</code>: put a label at the current position, where <code>id</code> is a string
that may be referenced in past and future <code>put*Label()</code> calls</p>
  </li>
  <li>
    <p><code>putCallAddressWithArguments(func, args)</code>: put code needed for calling a C
function with the specified <code>args</code>, specified as a JavaScript array where
each element is either a string specifying the register, or a Number or
NativePointer specifying the immediate value.</p>
  </li>
  <li>
    <p><code>putCallRegWithArguments(reg, args)</code>: put code needed for calling a C
function with the specified <code>args</code>, specified as a JavaScript array where
each element is either a string specifying the register, or a Number or
NativePointer specifying the immediate value.</p>
  </li>
  <li>
    <p><code>putJAddress(address)</code>: put a J instruction</p>
  </li>
  <li>
    <p><code>putJLabel(labelId)</code>: put a J instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putJrReg(reg)</code>: put a JR instruction</p>
  </li>
  <li>
    <p><code>putJalAddress(address)</code>: put a JAL instruction</p>
  </li>
  <li>
    <p><code>putJalrReg(reg)</code>: put a JALR instruction</p>
  </li>
  <li>
    <p><code>putBOffset(offset)</code>: put a B instruction</p>
  </li>
  <li>
    <p><code>putBeqRegRegLabel(rightReg, leftReg, labelId)</code>: put a BEQ instruction
referencing <code>labelId</code>, defined by a past or future <code>putLabel()</code></p>
  </li>
  <li>
    <p><code>putRet()</code>: put a RET instruction</p>
  </li>
  <li>
    <p><code>putLaRegAddress(reg, address)</code>: put a LA instruction</p>
  </li>
  <li>
    <p><code>putLuiRegImm(reg, imm)</code>: put a LUI instruction</p>
  </li>
  <li>
    <p><code>putOriRegRegImm(rt, rs, imm)</code>: put an ORI instruction</p>
  </li>
  <li>
    <p><code>putLwRegRegOffset(dstReg, srcReg, srcOffset)</code>: put a LW instruction</p>
  </li>
  <li>
    <p><code>putSwRegRegOffset(srcReg, dstReg, dstOffset)</code>: put a SW instruction</p>
  </li>
  <li>
    <p><code>putMoveRegReg(dstReg, srcReg)</code>: put a MOVE instruction</p>
  </li>
  <li>
    <p><code>putAdduRegRegReg(dstReg, leftReg, rightReg)</code>: put an ADDU instruction</p>
  </li>
  <li>
    <p><code>putAddiRegRegImm(destReg, leftReg, imm)</code>: put an ADDI instruction</p>
  </li>
  <li>
    <p><code>putAddiRegImm(destReg, imm)</code>: put an ADDI instruction</p>
  </li>
  <li>
    <p><code>putSubRegRegImm(destReg, leftReg, imm)</code>: put a SUB instruction</p>
  </li>
  <li>
    <p><code>putPushReg(reg)</code>: put a PUSH instruction</p>
  </li>
  <li>
    <p><code>putPopReg(reg)</code>: put a POP instruction</p>
  </li>
  <li>
    <p><code>putMfhiReg(reg)</code>: put a MFHI instruction</p>
  </li>
  <li>
    <p><code>putMfloReg(reg)</code>: put a MFLO instruction</p>
  </li>
  <li>
    <p><code>putMthiReg(reg)</code>: put a MTHI instruction</p>
  </li>
  <li>
    <p><code>putMtloReg(reg)</code>: put a MTLO instruction</p>
  </li>
  <li>
    <p><code>putNop()</code>: put a NOP instruction</p>
  </li>
  <li>
    <p><code>putBreak()</code>: put a BREAK instruction</p>
  </li>
  <li>
    <p><code>putInstruction(insn)</code>: put a raw instruction as a JavaScript Number</p>
  </li>
  <li>
    <p><code>putBytes(data)</code>: put raw data from the provided ArrayBuffer</p>
  </li>
</ul>

<h2 id="mipsrelocator">MipsRelocator</h2>

<ul>
  <li>
    <p><code>new MipsRelocator(inputCode, output)</code>: create a new code relocator for
copying MIPS instructions from one memory location to another, taking
care to adjust position-dependent instructions accordingly.
The source address is specified by <code>inputCode</code>, a NativePointer.
The destination is given by <code>output</code>, a <a href="https://frida.re/docs/javascript-api/#mipswriter">MipsWriter</a> pointed
at the desired target memory address.</p>
  </li>
  <li>
    <p><code>reset(inputCode, output)</code>: recycle instance</p>
  </li>
  <li>
    <p><code>dispose()</code>: eagerly clean up memory</p>
  </li>
  <li>
    <p><code>input</code>: latest <a href="https://frida.re/docs/javascript-api/#instruction">Instruction</a> read so far. Starts out <code>null</code>
and changes on every call to <code>readOne()</code>.</p>
  </li>
  <li>
    <p><code>eob</code>: boolean indicating whether end-of-block has been reached, i.e. we’ve
reached a branch of any kind, like CALL, JMP, BL, RET.</p>
  </li>
  <li>
    <p><code>eoi</code>: boolean indicating whether end-of-input has been reached, e.g. we’ve
reached JMP/B/RET, an instruction after which there may or may not be valid
code.</p>
  </li>
  <li>
    <p><code>readOne()</code>: read the next instruction into the relocator’s internal buffer
and return the number of bytes read so far, including previous calls.
You may keep calling this method to keep buffering, or immediately call
either <code>writeOne()</code> or <code>skipOne()</code>. Or, you can buffer up until the desired
point and then call <code>writeAll()</code>.
Returns zero when end-of-input is reached, which means the <code>eoi</code> property is
now <code>true</code>.</p>
  </li>
  <li>
    <p><code>peekNextWriteInsn()</code>: peek at the next <a href="https://frida.re/docs/javascript-api/#instruction">Instruction</a> to be
written or skipped</p>
  </li>
  <li>
    <p><code>peekNextWriteSource()</code>: peek at the address of the next instruction to be
written or skipped</p>
  </li>
  <li>
    <p><code>skipOne()</code>: skip the instruction that would have been written next</p>
  </li>
  <li>
    <p><code>writeOne()</code>: write the next buffered instruction</p>
  </li>
  <li>
    <p><code>writeAll()</code>: write all buffered instructions</p>
  </li>
</ul>

<h2 id="mips-enum-types">MIPS enum types</h2>

<ul>
  <li>Register: <code>v0</code> <code>v1</code> <code>a0</code> <code>a1</code> <code>a2</code> <code>a3</code> <code>t0</code> <code>t1</code> <code>t2</code> <code>t3</code> <code>t4</code> <code>t5</code> <code>t6</code>
<code>t7</code> <code>s0</code> <code>s1</code> <code>s2</code> <code>s3</code> <code>s4</code> <code>s5</code> <code>s6</code> <code>s7</code> <code>t8</code> <code>t9</code> <code>k0</code> <code>k1</code> <code>gp</code> <code>sp</code>
<code>fp</code> <code>s8</code> <code>ra</code> <code>hi</code> <code>lo</code> <code>zero</code> <code>at</code> <code>0</code> <code>1</code> <code>2</code> <code>3</code> <code>4</code> <code>5</code> <code>6</code> <code>7</code> <code>8</code>
<code>9</code> <code>10</code> <code>11</code> <code>12</code> <code>13</code> <code>14</code> <code>15</code> <code>16</code> <code>17</code> <code>18</code> <code>19</code> <code>20</code> <code>21</code> <code>22</code> <code>23</code>
<code>24</code> <code>25</code> <code>26</code> <code>27</code> <code>28</code> <code>29</code> <code>30</code> <code>31</code></li>
</ul>


          





  
  

  
  

  
  

  
  

  
  

  
  

  
  

  
  

  
  

  
  

  
  

  
  

  
  

  
  

  
  

  
  

  
  

  
  

  
  

  
  

  
  

  
  

  
  

  
  
    <div class="section-nav">
      <div class="left align-right">
          
            
            
            <a href="https://frida.re/docs/frida-kill/" class="prev">Back</a>
          
      </div>
      <div class="right align-left">
          
            
            
            <a href="https://frida.re/docs/c-api/" class="next">Next</a>
          
      </div>
    </div>
    <div class="clear"></div>
    

        </article>
      </div>

    </div>
  </section>


  <footer>
  <div class="grid">
    <div class="unit whole align-right center-on-mobiles">
      <div class="sponsored-by">
        <h5>Sponsored by:</h5>
        <a href="https://www.nowsecure.com/">
          <img src="./JavaScript API _ Frida • A world-class dynamic instrumentation framework_files/nowsecure-logo.png" alt="NowSecure">
        </a>
      </div>
    </div>
  </div>
</footer>

  


  <!-- Google Analytics (http://google.com/analytics) -->
  <script type="text/javascript">
    var _gaq = _gaq || [];
    _gaq.push(['_setAccount', 'UA-46880695-1']);
    _gaq.push(['_setDomainName', 'https://www.frida.re']); // Multiple sub-domains
    _gaq.push(['_setAllowLinker', true]); // Multiple TLDs
    _gaq.push(['_trackPageview']);
    (function() {
      var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
      ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
      var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
    })();
  </script>





</body></html>